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Abstract— Hydrogen  will  be  used  as  aviation  fuel  in  the  foreseeable  future. 
First  flight  tests  with  a  hydrogen  demonstrator  aircraft,  currently  under 
investigation  in  the  scope  of  the  German- Russian  Cryoplane  project,  are 
scheduled  for  1999.  Regular  service  with  regional  aircraft  may  begin  around 
2005,  followed  by  larger  Airbus-type  airliners  around  2010-2015.  The  fuel 
storage  aboard  such  airliners  will  be  of  the  order  of  15  t  or  roughly  200  m3 
LH2.  This  paper  investigates  a  number  of  safety  problems  associated  with 
the  handling  and  air  transport  of  so  much  hydrogen.  The  same  is  done  for 
the  infrastructure  on  the  airport.  Major  risks  are  identified,  and  appropriate 
measures  in  design  and  operation  are  recommended.  It  is  found  that  hydrogen 
aircraft  are  no  more  dangerous  than  conventional  ones — safer  in  some 
respects.  Many  risks  can  be  avoided  by  suitable  constructive  measures,  and 
the  rest  are  bearable.  The  real  challenge  lies  with  the  dimensions  of  the 
installations  on  the  airfields  which  will  become  necessary  when  hydrogen 
aircraft  become  common.  ©  1998  Elsevier  Science  Ltd.  All  rights  reserved 


1.  INTRODUCTION 

1.1.  Why  we  need  hydrogen 

The  introduction  of  hydrogen  technology  is  much  more  than  just  a  technical  transition 
to  a  more  economical  or  practical  fuel.  Conventional  fossil  fuels  will  soon  no  longer  be 
available  in  sufficient  amounts  because  of  the  exhaustion  of  resources.  This  problem 
becomes  more  and  more  evident  due  to  the  growth  of  the  world  population  and  the  rapid 
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industrial  development  of  some  of  the  most  populated  regions  of  the  earth.  An  even  more 
important  aspect  is  that  the  consumption  of  conventional  fuels  damages  the  atmosphere 
locally  (air  pollution)  and  globally  (greenhouse  effect,  ozone  depletion).  Even  the  use  of  all 
available  means  to  save  energy  right  now  could  not  turn  the  trend  fundamentally.  This  is  a 
danger  to  the  whole  earth. 

Hydrogen  is  the  most  promising  candidate  for  an  alternative  fuel  in  a  new  global  energy 
system.  It  is  available  on  earth  in  abundant  supply,  even  though  it  must  be  separated  from 
water  or  other  chemical  compounds  before  use.  The  environmental  effect  associated  with 
its  combustion  or  other  use  is  negligible.  Even  in  case  of  an  accident  it  is  less  dangerous 
than  conventional  hydro-carbon  fuels. 

1.2.  Why  at  ia  i  ion  needs  hydrogen 

The  necessary  steps  towards  hydrogen  technology  must  also  be  carried  out  in  aviation, 
even  though  air  transport  may  be  a  luxury  for  large  parts  of  the  world  population  and  the 
absolute  impact  of  aviation  on  the  environment  is  smaller  than  that  of  surface  transport. 
For  the  economy  of  the  industrialized  world,  however,  air  transport  plays  a  key  role.  Per 
passenger  and  mile,  air  transport  causes  comparably  high  environmental  impacts,  since 
pollutants  are  emitted  in  very  sensitive  layers  of  the  atmosphere  [1].  Moreover,  local  air 
pollution  around  major  airports  cannot  be  neglected. 

This  is  why  the  aviation  industry  must  also  be  prepared  for  the  introduction  of  hydrogen 
fuel.  The  Cryoplane  project  is  carried  out  with  this  background  in  mind. 


2.  THE  CRYOPLANE  PROJECT 


2.1.  Objective 

Cryoplane  is  a  joint  project  by  Daimler-Benz  Aerospace  Airbus  (Germany)  and  Tupolev 
(Russia)  as  well  as  a  number  of  other  partners.  The  objective  is  to  develop  commercial 
aircraft  using  liquefied  natural  gas  (LNG)  or  liquid  hydrogen  (LH2)  instead  of  kerosene. 

Important  work  to  this  end  was  done  by  Tupolev  in  the  1980s.  A  lot  of  experience  has 
been  gathered  by  developing  and  operating  a  flying  laboratory  called  Tu-155  which  first 
flew  in  1988.  The  results  will  be  used  for  the  Cryoplane  project. 

As  a  first  step  towards  cryogenic  fuel  aircraft,  the  modification  of  conventional  com¬ 
mercial  transport  is  considered.  The  modifications  will  mainly  affect  fuel  storage  and 
engines.  Later  generations  of  aircraft  wall  have  to  be  adapted  to  the  particular  characteristics 
of  cryogenic  fuels,  above  all  the  comparably  high  volume  requirements  which  may  lead  to 
configurations  much  different  from  those  of  kerosene  aircraft.  An  example  is  show'n  in  Figs 
1-3  featuring  two  cylindrical  LH2  tanks  mounted  above  the  wrings  and  connected  to  the 
horizontal  tail. 

2.2.  Economical  considerations 

The  product  cycles  of  commercial  aircraft  are  of  the  order  of  50  years  ( from  the  start  of 
development  to  the  phasing  out  of  the  last  serial  aircraft).  The  first  large  Cryoplane  aircraft 
may  enter  into  service  in  the  time  frame  2010-2015  [2,  3]. 

Fuel  prices  wall  undergo  dramatic  changes  until  then.  Kerosene  and  other  hydrocarbon 
fuels  will  become  more  expensive  due  to  the  exhaustion  of  the  reserves  and  possibly  due  to 
environmental  taxation,  while  the  price  of  hydrogen  will  drop  due  to  improved  supply  (see 
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Fig.  1 .  Design  study  of  an  LH2  aircraft  (reproduced  with  kind  permission  of  Tupolev  Aviation 

Corporation,  Moscow),  side  view. 


Fig.  3.  Design  study  of  an  LH2  aircraft,  front  view. 


Fig.  4).  This  alone  is  a  compelling  reason  for  starting  the  development  of  alternatives  now, 
apart  from  all  the  ecological  considerations. 

The  accuracy  of  such  forecasts  depends  always  on  global  political  and  economical 
developments  which  are  difficult  to  predict.  The  introduction  of  the  nuclear  aircraft  and  of 
the  1000  passenger  Jumbo  were  announced  in  the  1960s  for  the  mid-1980s  [4].  The  interest 
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Fig.  4.  Kerosene  and  LH2  price  trend  to  be  expected  during  the  Cryoplane  life  cycle. 


in  hydrogen  aircraft  and  hydrogen  technology,  however,  has  deeper  roots  than  just  the 
technical  or  business  progress;  political  and  economical  boundary  conditions  may  delay  it, 
but  are  not  likely  to  stop  it. 


3.  RISKS  ASSOCIATED  WITH  HYDROGEN 

3.1.  Physical  properties 

The  selection  of  LH2  fuel  will  provide  a  safety  advantage  to  hydrogen  aircraft  and 
airports  in  certain  respects,  because  many  safety  problems  associated  with  oil  or  products 
refined  from  it  do  not  exist  at  all.  In  contrast  to  conventional  liquid  fuels  hydrogen  is  a  gas 
that  cannot  seep  into  the  ground  and  contaminate  soil  and  water.  Such  things  happened 
with  kerosene  for  years  on  some  airports  (e.g.  Frankfurt  Airbase)  without  anybody  noticing 
it. 

The  storage  of  hydrogen  as  cryogenic  liquid  is  in  certain  respects  safer  than  storing  it  as 
compressed  gas,  because  the  lower  pressure  reduces  the  mechanical  loads  on  the  tank  and 
thus,  the  problem  of  material  fatigue.  An  accident  of  the  Hanau  type,  the  characteristic 
feature  of  which  was  early  material  fatigue  due  to  cyclic  tensions  under  the  influence  of 
compressed  hydrogen  at  ambient  temperature,  would  be  most  unlikely  in  connection  with 
liquid  hydrogen,  because  the  pressures  are  generally  lower  and  do  not  vary  cyclically  with 
consumption  or  tank  fill  ratio  to  the  same  extent  [5,  6].  The  designer  of  hydrogen  tanks  or 
devices  must,  however,  consider  that  hydrogen  at  the  same  time  favours  fatigue  and 
embrittlement  of  certain  materials  [5].  This  is  an  effect  not  of  the  hydrogen  molecule,  but 
of  the  atom,  and  happens  faster  when  the  pressure  is  higher. 
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The  low  temperature  of  LH2  may  make  handling  more  complicated  and  thus  sensitive  to 
problems.  There  might  be  an  insulating  vacuum  as  an  additional  component  which  can 
cause  difficulties  of  its  own.  Also  to  be  considered  are  the  effects  of  the  low  temperature  on 
the  materials  in  contact  with  the  cryogen.  Characteristic  properties  will  change,  and  organic 
or  other  elastic  materials  in  particular  become  brittle. 

Another  problem  is  related  to  the  small  size  of  the  hydrogen  molecule.  It  can  pass  through 
narrow  openings  more  easily  than  air  or  other  comparable  gases,  which  means  that  the 
measurement  of  a  leak  rate  with  air  will  give  misleading  results.  Hydrogen  can  even  enter 
solid  materials  by  means  of  permeation,  in  particular  polymers.  While  it  can  be  shown  that 
this  effect  is  not  important  at  20  K,  there  are  always  warm  parts  in  any  construction, 
therefore  materials  should  be  chosen  carefully  [7,  8|. 

3.2.  Chemical  properties 

The  only  major  chemical  risk  associated  with  hydrogen  under  ambient  conditions  is  its 
flammability.  This  is,  of  course,  common  to  all  fuels.  Gaseous  hydrogen  can  also  mix  with 
air  and  form  flammable  and  explosive  mixtures  more  easily  than  kerosene  vapours. 

The  heat  radiation  of  a  hydrogen  flame  is  only  about  10  %  of  that  of  a  hydrocarbon 
flame,  which  means  that  the  site  of  a  hydrogen  fire  is  more  easily  accessible  for  rescue  forces 
than  a  hydrocarbon  fuel  fire. 

These  properties  do  not  depend  on  whether  hydrogen  is  stored  as  gas  or  cryogenic  liquid. 

3.3.  Physiological  properties 

Hydrogen  is  neither  poisonous  nor  corrosive.  It  may,  of  course,  be  asphyxiating  if  it  is 
present  in  such  an  amount  that  not  enough  oxygen  is  left  for  breathing.  Spilled  hydrogen 
pollutes  neither  surface  or  ground  water,  nor  the  soil. 

The  low  temperature  of  LH2  may  have  physiological  effects  in  case  of  release;  while  the 
liquid  itself  will  usually  not  hurt  the  skin  due  to  the  vapour  cushion  between  the  cold  liquid 
and  the  warm  skin  (“Leidenfrost  effect”),  injuries  comparable  to  burning  may  occur  when 
cold  metal  parts  are  touched. 

3.4.  Facts  and  fiction 

While  most  experts  agree  that  the  risks  associated  with  hydrogen  are  even  smaller  than 
in  case  of  conventional  fuels  [9]  (not  even  considering  the  ecological  balance),  the  public 
have  a  quite  different  opinion.  There  are  widespread  misgivings  about  the  use  of  hydrogen 
for  any  purpose.  This  is  commonly  known  as  the  “Hindenburg  Syndrome”,  referring  to 
the  most  spectacular  hydrogen  accident. 

The  main  reason  for  this  hydrogen  fear  is  that  the  public  is  not  used  to  hydrogen 
in  contrast  to  oil  products,  and  while  spectacular  hydrogen  accidents  like  that  of  the 
“Hindenburg”  remain  in  memory  for  decades,  people  get  used  to  severe  car  crashes  and  oil 
spills.  The  success  of  hydrogen  technology  depends,  therefore,  not  only  on  suitable  technical 
provisions  but  also  on  skilful  and  honest  public  relations  work. 

3.5.  Objective  of  this  study 

The  high  public  safety  demands  on  technical  installations  of  any  kind,  the  high  safety 
standards  which  exist  in  aviation  anyway,  and  the  special  technical  and  psychological 
problems  associated  with  hydrogen  are  the  basis  for  a  particular  necessity  of  safety  related 
research  in  connection  with  projects  like  the  Cryoplane. 
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This  study  will  identify  the  most  likely  and  hazardous  emergency  situations  in  the 
operation  of  a  hydrogen  aircraft  and  propose  suitable  countermeasures.  Most  of  the  danger 
is  related  to  the  uncontrolled  release  and  dispersion  ofignitable  gas  mixtures.  An  explosion 
at  an  airport  would  affect  many  people  and  cause  high  damage.  It  would  be  even  more 
dangerous  on  board  an  aeroplane,  because  countermeasures  during  flight  are  limited,  and 
it  is  not  possible  to  walk  away  from  the  danger.  This  is  why  both  airport  and  aircraft  are 
the  object  of  this  study. 


4.  STATE  OF  THE  ART 


4.1.  General 

The  existence  of  hydrogen  has  been  known  for  200  years,  and  its  properties  have  been 
studied  extensively,  including  those  of  the  condensed  phases.  Also  known  are  the  relevant 
safety  properties  of  hydrogen  in  comparison  with  natural  gas,  petroleum  gases,  common 
jet  fuel,  car  fuel,  and  similar  substances.  Comparisons  can  be  found  in  [9]  and  many  other 
sources. 

4.2.  Hydrogen  aircraft 

The  role  of  hydrogen  in  aviation  was  originally  to  provide  buoyancy  for  balloons  and 
airships.  The  only  large  scale  application  of  hydrogen  as  fuel  is  for  spacecraft.  All  other 
work  in  this  field  was  experimental  in  nature. 

The  first  prototype  of  a  hydrogen  aircraft  flew  in  1956.  It  was  a  modified  B57  bomber 
running  on  liquid  hydrogen  (LH2).  Various  fuel  supply  systems  were  investigated  [10]. 

The  latest  example  is  Tupolev’s  '‘flying  laboratory’'  Tu-155  mentioned  above.  It  is  a 
modified  commercial  aircraft  on  the  basis  of  the  successful  type  Tu-154,  with  the  right 
engine  modified  in  such  a  way  that  it  can  be  run  on  kerosene,  LNG,  or  LH2.  Experiments 
have  been  carried  out  since  1988,  and  the  results  will  have  an  effect  on  Cryoplane  [11]. 

4.3.  Supply  and  infrastructure 

The  infrastructure  for  hydrogen  aircraft  was  investigated  in  two  studies  made  for  NASA 
in  the  1970s.  Necessary  installations  for  the  supply  and  the  related  investments  were 
identified  on  the  basis  of  the  conditions  for  the  airports  of  San  Francisco  [12]  and  Chicago 
[13].  Safety  matters  were  dealt  with  in  these  studies,  but  not  primarily.  A  similar  study  with 
the  focus  on  economics  was  made  in  the  1980s  for  Zurich  airport  [14]. 

4.4.  General  hydrogen  safety 

There  are  investigations  on  hydrogen  related  safety  matters  for  aerospace  purposes  which 
will  be  dealt  with  below.  There  is,  however,  also  experience  relevant  to  aviation  which  has 
been  gathered  outside  the  aerospace  industry. 

The  technically  most  advanced  project  for  the  demonstration  of  production,  transport, 
storage,  and  use  of  LH2  fuel  is  the  "Euro-Quebec  Hydro-Hydrogen  Pilot  Project” 
(EQHHPP)  [15,  16]  which  is  a  joint  activity  of  the  European  Union  and  the  Canadian 
province  of  Quebec.  LH2  will  be  transported  by  means  of  a  special  ship  from  Quebec  to 
Hamburg  to  be  used  in  various  model  applications.  Some  valuable  specific  safety-related 
work  has  been  done  in  this  context.  In  addition  there  have  been  studies  from  Canada  about 
the  likely  effects  of  large  scale  LH2  use  for  advanced  technologies  [17],  Another  EQHHPP 
study  by  the  Research  Center  Julich  (Germany)  deals  with  the  probability  of  LH2  ship 
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accidents  on  the  Elbe  river  and  their  effects  together  with  cryogenic  pool  behaviour  [18]; 
the  results  can  be  compared  with  those  for  LNG  ships  [19]. 

In  May  1994  the  Federal  Institute  for  Materials  Research  and  Testing  (BAM)  carried 
out  experiments  on  the  dispersion  behaviour  of  hydrogen/air  clouds  in  the  framework  of 
the  EQHHPP  [20,  21].  These  tests  were  made  between  houses  to  get  a  surrounding  similar 
to  an  actual  accident  site.  Comparative  tests  were  made  with  LPG  (i.e.  Liquefied  Petroleum 
Gases,  in  particular  propane).  Ignition  experiments  with  such  clouds  will  be  made  later. 

The  nuclear  industry  has  an  interest  of  its  own  in  hydrogen  safety.  In  1991  the  Research 
Center  Julich  carried  out  experiments  [22]  with  balloons  containing  approximately  50  m3 
of  hydrogen/air  mixture  that  were  ignited  by  means  of  an  explosive  detonator.  The  mixture 
ratio  was  either  stoichiometric  or  just  above  the  lower  detonation  limit.  The  objective  was 
to  gather  knowledge  about  the  detonation  of  such  mixtures  and  about  the  defla¬ 
gration/detonation  transition  process. 

Accident  simulation  is  valuable,  but  the  cause  and  mechanism  of  real  accidents  must  also 
be  investigated.  One  important  example  from  the  more  recent  past  is  the  gas  tank  accident 
which  happened  at  Hanau  (Germany)  [5].  There  are  also  compilations  of  different  types  of 
hydrogen  accident  with  statistical  data  covering  cause  and  effect  [6]. 

4.5.  A  erospace  safe  ty 

There  are  numerous  investigations  and  handbooks  on  aviation  safety  generally.  In  one 
of  them  [23]  estimations  of  the  effects  of  fuel  explosions  (pressure  waves,  debris  impact) 
can  be  found. 

Most  studies  about  the  particular  matter  of  hydrogen  safety  were  related  to  the  US  space 
program.  Some  of  them  simulated  hydrogen  accidents  and  observed  the  effects.  Many  of 
them  are  no  longer  new,  but  still  the  standard.  There  has  been  a  marked  decrease  of  these 
activities  since  the  end  of  the  Apollo  program  in  the  mid-1970s.  Similar  investigations  were 
made  in  the  U.S.S.R.,  but  are  not  so  widely  published. 

There  are  not  many  aerospace  investigations  with  the  special  attention  to  hydrogen 
safety.  General  studies  and  compilations  are  for  example  [24]  or  [25].  Some  particular 
publications  should  be  mentioned  here. 

•  Lockheed  investigated  the  detonation  risk  associated  with  hydrogen/air  mixtures  (this 
was  done  in  connection  with  the  work  on  the  hydrogen  aircraft  prototype).  Release  and 
vaporization  of  LH2  were  assumed  as  source  of  the  mixture.  The  results  have  not  been 
published  widely  because  the  whole  program  was  aborted  [26]. 

•  Much  better  known  are  the  Arthur  D.  Little  experiments  [27].  Various  amounts  of  LH2 
were  spilled  in  an  open  area,  and  the  mixture  dispersion  and  other  effects  were  observed. 
Comparative  experiments  with  conventional  fuels  and  ignitions  were  made. 

•  More  systematic  and  greater  experiments  of  this  kind  were  made  by  NASA  [28,  29].  The 
results  have  the  same  direction. 

These  and  previous  studies,  as  well  as  our  own  experience,  were  evaluated  by  Airbus  for 
the  Cryoplane  project  [11]. 

4.6.  Regulations 

There  are  regulations  for  potentially  dangerous  plants  and  devices  in  every  individual 
country,  and  there  are  also  regional  rules  (e.g.  those  of  the  European  Union)  and  inter¬ 
national  rules  (e.g.  those  for  the  transport  of  dangerous  goods).  In  Germany,  pressure 
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vessels  on  the  ground  are  subject  to  the  Pressure  Vessel  Decree  (Druckbehalterverordnung 
[30])  and  its  Technical  Rules.  Other  applicable  German  rules  are  those  concerning  explosion 
protection  [31],  work  sites  [32]  and  commercial  handling  of  dangerous  chemical  substances 
[33].  Of  particular  importance  is  the  law  regarding  the  protection  of  the  environment 
(Bundes-Immissionsschutzgesetz  [34])  with  its  various  decrees,  in  particular  the  regulation 
concerning  emergencies  (Stdrfallverordnung).  Air  transport  is  not  in  the  scope  of  some  of 
these  regulations,  but  a  large  part  of  their  content  can  be  found  in  specifically  applicable 
rules.  While  other  countries  have  different  regulations,  they  are  being  continuously  har¬ 
monized  at  least  between  the  member  states  of  the  European  Union,  as  a  result  of  the 
progress  in  the  creation  of  a  single  interior  market. 

There  are  also  comprehensive  regulations  for  conventional  aircraft  and  air  transport, 
which  deal  with  transport  and  environmental  matters  and  also  with  safety.  Liquid  hydrogen 
is,  not  surprisingly,  not  considered  by  them.  Technical  safety  and  the  protection  of  the 
public,  however,  are  a  key  issue  for  the  whole  hydrogen  technology.  This  means  that  not 
only  more  and  new  research,  but  also  a  parallel  development  of  the  regulations  are  necessary 
[35].  This  holds  not  only  for  air  transport,  but  generally  for  matters  of  transport,  transfer, 
and  storage  of  LH2  [36,  37], 

Regulations  must  have  deficiencies  because  they  can,  by  their  very  nature,  best  reflect  the 
present  technical  knowledge;  they  cannot  pioneer  the  way  for  new  developments  like 
Cryoplane.  The  experience  collected  in  them,  however,  can  and  will  be  used  whenever 
necessary  or  useful. 


5.  AIRPORT  DESIGN 


5.1.  State  of  the  art 

No  present  airport  has  facilities  for  the  supply  of  hydrogen  aircraft  because  there  are 
none  in  regular  service.  There  are,  however,  investigations  into  what  such  facilities  should 
look  like  [12-14].  The  assumptions  made  here  about  the  traffic  at  the  airport  will  be  basically 
the  same  as  those  made  in  the  study  for  San  Francisco  [12].  The  main  points  will  be 
summarized  below  and  compared  with  the  more  recent  results  of  the  Cryoplane  proposals. 

5.2.  Liquefaction 

While  [12]  proposes  the  delivery  of  gaseous  hydrogen  to  a  liquefaction  plant  at  the 
airport,  Cryoplane  favours  the  production  of  hydrogen  on  the  site  by  means  of  electrolysis. 

Hydrogen  liquefaction  will  be  done  at  the  airport  site.  The  liquid  will  be  distributed  from 
there  to  the  aircraft  without  further  intermediate  transport.  The  distribution  of  hydrogen 
liquefied  elsewhere  by  means  of  tank  cars  or  pipelines  would  be  uneconomical,  because  of 
the  high  consumption  of  the  airport.  It  would  also  cause  additional  and  serious  safety 
problems. 

The  supply  of  a  plant  of  this  type  with  dimensions  discussed  below  with  energy  and  raw 
materials  is  an  important  design  problem,  but  not  included  in  the  scope  of  this  study. 

5.3.  Liquefier  capacity 

While  a  hydrogen  liquefier  for  an  airport  would  in  itself  not  differ  much  from  any  other 
plant  of  this  kind,  the  specific  environment  must  be  considered. 

The  risk  associated  with  a  plant  depends  on  the  hydrogen  inventory,  which  in  turn 
depends  on  the  demand  to  be  expected.  The  daily  demand  varies,  and  must  be  taken  into 
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account  in  the  storage  design.  There  are  also  seasonal  variations  with  a  demand  peak  in 
summer.  The  studies  for  San  Francisco  [12]  and  Chicago  [13]  came  to  the  conclusion  that 
an  average  daily  demand  of  800 t  would  be  likely  and  recommended  a  plant  design  for  1000 
t/d. 

The  estimations  made  for  Cryoplane  take  into  account  the  airport  size  distribution.  The 
results  vary  between  40  t/d  for  a  small  German  airport  (e.g  Bremen)  and  4000  t/d  for  a 
major  site  (e.g.  Frankfurt).  Berlin’s  future  airport  would  be  somewhere  in  between  with 
1600  t/d  [11].  The  accuracy  of  such  predictions  may  be  affected  by  global  developments; 
the  importance  of  Berlin,  for  example,  will  depend  on  the  economical  progress  in  central 
and  eastern  Europe.  Such  internal  variations,  however,  would  have  no  effect  on  the  global 
situations.  This  paper  does  not  deal  with  the  specific  conditions  of  a  particular  airport. 

5.4.  Considerations  associated  with  the  plant  size 

Hydrogen  liquefiers  are  state  of  the  art,  but  the  capacity  under  discussion  is  not.  The 
most  important  plants  in  Western  Europe  are  at  Ingolstadt  (Germany)  [38],  Rozenburg 
(near  Rotterdam,  The  Netherlands)  and  Waziers  (near  Lille,  France).  The  total  production 
in  Western  Europe  is  about  20  t/d  [38],  which  is  less  than  the  demand  of  even  one  small 
airport.  The  largest  plants  in  the  world  have  a  capacity  of  about  30  t/d,  while  250  t/d  are 
considered  as  economical  maximum  [39].  The  largest  plants  serve  space  centres  (Flo¬ 
rida/NASA,  Kourou/ESA). 

The  energy  demand  of  such  a  plant  would  also  exceed  present  dimensions.  The  demand 
of  the  future  airport  of  Berlin  has  been  estimated  to  be  roughly  the  same  as  the  whole 
capacity  of  all  power  plants  in  former  West  Berlin  (which  was  a  city  of  2  million  inhabitants) 
[Hi. 

Hydrogen  aircraft  can  make  sense  commercially  only  if  there  is  a  sufficient  number  of 
airports  with  hydrogen  facilities,  otherwise  they  could  operate  between  two  or  three  places 
only.  Figure  5  shows  which  airports  would  have  to  be  suitably  equipped  if  just  wide-body 


Fig.  5.  Hydrogen  airports  in  Europe,  initial  stage. 
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Fig.  6.  Hydrogen  airports  in  Europe,  final  stage. 


aircraft  in  inner-European  service  were  to  use  hydrogen.  The  corresponding  pattern  for  the 
whole  air  transport  into  and  from  Europe  is  given  in  Fig,  6  [1 1],  Similar  considerations  can 
be  made  for  North  America  or  Eastern  Asia.  It  is  easy  to  recognize  that  this  will  require 
not  so  much  a  technical  but  rather  an  economical  transition  of  major  extent. 

5.5.  Modular  design 

There  are  technical  and  economical  limits  for  the  capacity  of  a  hydrogen  liquefier.  The 
above  mentioned  limit  of  250  t/d  [39]  is  rather  a  theoretical  value.  Existing  facilities  are 
limited  to  50  or  60  t/d  because  of  the  compressor  capacity.  Though  one  liquefier  could,  of 
course,  be  served  by  more  than  one  compressor  [11],  the  plant  must  have  a  modular  design 
in  any  case.  Cost  and  technical  reasons  favour  a  uniform  design  of  the  modules  with  a 
capacity  of  about  60  t/d. 

Even  for  small  airports  three  modules  would  be  recommended  to  guarantee  uninterrupted 
operation  even  if  one  module  is  out  of  operation  for  maintenance  or  some  other  reason. 
Larger  airports  must,  of  course,  have  more  liquefier  modules. 

5.6.  Hydrogen  storage 

Even  though  the  customers  of  the  liquefier  are  not  far  away,  extensive  storage  facilities 
will  be  necessary,  mainly  for  three  reasons: 

•  a  buffer  volume  should  guarantee  the  supply  even  in  times  of  peak  demand; 

•  the  liquid  should  be  stored  somewhere  in  case  of  low  demand  in  order  to  avoid  inter¬ 
ruptions  of  the  plant  operation; 

•  flight  operations  should  not  be  affected  by  plant  failures. 

While  the  liquefier  should  operate  continuously,  the  demand  varies  considerably  with  time. 
It  is  very  small  between  22:00  and  06:00  on  most  airports.  This  means  that  the  storage  should 
at  least  accommodate  the  production  of  eight  hours,  while  more  is  strongly  recommendable. 
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The  Cryoplane  studies  assume  LH2  storage  tanks  of  1700  in3  (120  t)  each  [11].  Such  a 
tank  could  serve  four  liquefier  modules,  so  that  the  number  of  tanks  per  airport  would  be 
between  one  and  fifteen.  Even  a  small  airport  should  have  more  than  one  tank,  preferably 
three. 

5.7.  Distribution 

The  LH2  fuel  will  be  distributed  by  means  of  a  vacuum  insulated  circular  pipeline 
supplying  various  tank  positions.  The  alternative  of  tank  cars  servicing  the  aircraft  is 
inferior  for  safety,  economical,  and  ecological  reasons.  Each  additional  transfer  is  a  risk 
and  associated  with  losses.  At  least  some  positions  in  the  maintenance  area  must  have  the 
equipment  for  emptying  full  tanks  and  recovering  the  liquid. 

For  redundancy  reasons  it  is  recommendable  to  have  a  double  LH2  pipeline  and  a  gas 
recovery  line.  Helium,  nitrogen  or  other  gases  must  be  available  for  purging. 

Pipelines  like  this  are  state  of  the  art  [40]. 

5.8.  Location  of  fuelling  positions 

The  aircraft  will  be  refuelled  at  gate  positions  or  near  the  terminals  in  parallel  with 
cleaning,  maintenance,  and  other  work,  as  well  as  disembarking  and  boarding  of  the 
passengers,  as  is  the  case  with  today’s  kerosene  aircraft. 

Various  other  methods  are  discussed  in  [12].  Among  these  are  special  tank  positions 
which  are  separated  from  the  passenger  area.  The  planes  would  have  to  return  to  the 
terminal  for  boarding,  or  the  passengers  would  have  to  be  shuttled  to  the  aircraft  by  means 
of  buses,  or  the  passenger  bridges  would  have  to  be  much  longer  than  at  present.  These 
alternatives  have  been  rejected  [12]  mainly  for  economical  reasons.  The  aircraft  would  have 
to  stay  at  the  airport  much  longer,  which  would  mean  a  significant  cost  increase.  No  safety 
advantage  is  apparent. 

Some  tank  positions  should  be  available  in  the  maintenance  area  for  the  servicing  of 
aircraft  w  hich  will  not  fly  again  in  the  near  future.  These,  of  course,  should  be  duly  separated 
from  the  passenger  area  and  from  the  other  flight  operations. 

5.9.  O  they  subs  tan  ces 

While  hydrogen  is  the  dominant  dangerous  substance  in  the  liquefier,  there  are  others  as 
well.  A  hydrogen  or  helium  liquefier  needs  considerable  amounts  of  liquid  nitrogen  (LN2). 
Another  essential  item  is  helium  because  it  is  the  only  substance  which  is  still  gaseous  at  20 
K.  Also  to  be  considered  are  electricity  and  other  things  necessary  for  the  operation. 


6.  AIRPORT  RISKS 


6.1.  Legal  aspects 

A  hydrogen  liquefier  in  Germany  would  have  to  be  approved  under  environment  legis¬ 
lation  (Bundes-Immissionsschutzgesetz,  Storfallverordnung  [34]).  Even  though  air  trans¬ 
port  facilities  may  not  be  completely  included  in  the  scope  of  [34],  it  w'ould  in  any  case  be 
necessary  under  EU  legislation  to  make  a  comprehensive  study  of  the  effects  of  the  plant 
on  the  environment  (UVPG  [41]).  Pressure  vessels  with  their  piping  and  equipment  in 
Germany  are  subject  to  the  pressure  vessel  legislation,  though  it  has  been  shown  elsew’here 
[36]  that  the  rules  are  rather  deficient  for  this  application.  The  plant  being  commercial  in 
nature,  the  rules  for  work  sites  [32]  and  dangerous  substances  [33]  must  be  considered. 
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This  paper  is  not  intended  for  German  readers  only,  however,  even  though  in  Germany 
the  environmental  legislation  does  not  fully  apply  to  air  transport  facilities,  the  approach 
demanded  in  [34]  can  be  applied  and  this  will  be  done  here.  Legal  requirements  will  be  given 
in  italics.  “Plant”  comprises  both  the  hydrogen  liquefier  and  the  Cryoplanes. 

6.2.  Normal  operation 

The  effects  of  a  plant  on  the  environment  should  already  be  as  low  as  possible  during  normal 
operation .  Adverse  effects  to  be  considered  are  mainly  noise  and  air  pollution. 

The  liquefier  is  negligible  in  comparison  to  the  air  traffic  in  both  regards.  The  main 
problem  with  the  exhaust  gases  is  the  reduction  of  their  NOx  content.  First  results  of 
hydrogen  combuster  tests  in  the  scope  of  the  Euro^Quebec  Hydro-Hydrogen  Pilot  Project 
have  indicated  a  NOx  reduction  potential  of  up  to  95  %  as  compared  to  conventional 
kerosene  engines.  Water  vapour,  according  to  recent  investigations  of  climatologic  insti¬ 
tutions,  has  no  significant  atmospheric  impact  up  to  cruise  altitudes  of  subsonic  airliners. 
Water  vapour  on  or  near  ground  is  legally  not  regarded  as  pollution  because  the  air  contains 
water  anyway.  All  other  emissions  are  negligible  due  to  the  use  of  hydrogen. 

As  far  as  the  approval  of  the  normal  operation  is  concerned,  an  airport  with  hydrogen 
facilities  might  cause  even  less  environmental  and  legal  problems  than  a  conventional  one. 

6.3.  Emergencies 

Plants  have  to  be  designed  and  operated  in  such  a  way  that  emergencies  are  avoided  as  far 
as  possible.  There  is  no  uncommon  risk  associated  to  the  operation  of  air  separation  plants 
and  helium  or  hydrogen  liquefiers,  but  they  are  a  proven  technology  and  have  a  high  safety 
level. 

Of  course,  even  the  safest  plant  will  inevitably  be  affected  by  accidents.  Plant  design  and 
operation  must  therefore  be  such  that  accident  effects  remain  on  a  low  level ,  preferably  inside 
the  plant.  Airports  already  have  a  high  level  of  technical  safety,  including  fire  brigade 
services.  The  measures  necessary  to  be  equipped  for  emergencies  in  the  operation  of 
hydrogen  facilities  like  these  should  not  be  extraordinary. 

6.4.  Effects  of  emergencies  elsewhere 

Safety  studies  must  include  not  only  dangers  arising  in  the  plant  itself.  Accidents  in  the 
vicinity  of  the  plant  should  not  have  dangerous  effects  on  it.  Such  accidents  will  occur  mainly 
in  connection  with  the  flight  operations.  They  can  cause  fire  and  flying  debris  which  could 
affect  the  liquefier.  This  risk  shall  be  minimized  by  suitable  choice  of  the  location  (off  the 
direction  of  the  approach  paths),  safety  distances,  protective  mounds  and  so  on.  The  plant 
should  be  as  isolated  as  possible. 

The  liquefier  and  the  rest  of  the  airport  shall  also  be  protected  against  the  effects  of 
accidents  outside  the  airport.  Which  accidents  exactly  are  likely  depends  on  the  particular 
site.  Such  effects  must  be  dealt  with  in  the  same  way  as  those  of  accidents  inside  the  airport. 

6.5.  Trespassing 

Damage  caused  by  unauthorized  persons,  whether  committed  maliciously  or  for  other 
reasons,  must  be  avoided  by  access  restrictions.  These  restrictions  must  be  enforced  more 
strictly  for  the  hydrogen  facilities  than  anywhere  else  in  the  airport,  even  after  the  operation 
has  become  a  routine.  Access  privileges  should  be  differentiated  and  temporary. 
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7.  PREVENTION  OF  AIRPORT  ACCIDENTS 
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7.1.  Liquefier  design 

Gas  liquefaction  plants  are  state  of  the  art.  What  is  necessary  to  make  them  run  safely  is 
already  known  [38],  only  the  size  is  unusual.  The  capacity  of  all  Western  European  plants 
together  is  one  order  of  magnitude  below  the  demand  of  one  major  airport,  as  mentioned 
earlier. 

Special  attention  must  be  given  to  those  components  which  must  be  developed  for  this 
application  so  that  there  is  no  experience  from  practical  service.  This  applies  in  particular 
for  LH2  pumps.  Pumps  are  recommended  in  [12]  for  thermodynamic  reasons,  and  their  use 
is  also  intended  for  Cryoplane.  Their  development,  however,  is  not  as  advanced  as  would 
be  desirable.  An  extensive  and  comprehensive  test  program,  including  all  normal  and 
abnormal  situations,  is  necessary  before  they  can  be  approved  for  service.  Accessories  and 
connections  are  known  as  weak  points,  because  they  are  involved  in  about  44  %  of  the 
accidents  [42]. 

The  most  dangerous  situations  are  caused  by  human  error.  This  can  happen  at  the 
liquefier  as  well,  even  though  a  great  part  of  the  operation  will  run  automatically.  Since, 
however,  the  personnel  are  specially  trained,  the  risk  is  comparatively  low,  provided  the 
level  of  training  and  education  is  maintained.  This  applies  in  particular  for  emergency 
measures. 

A  principal  potential  risk  of  LH2  is  its  low  temperature.  While  direct  contact  of  the  skin 
with  the  liquid  is  unlikely,  touching  cold  metallic  parts  should  be  avoided.  If  the  temperature 
of  the  metallic  parts  which  are  in  contact  with  air  falls  or  may  fall  below  90  K,  oxygen  can 
condense  on  them.  This  is  particularly  dangerous  if  the  liquid  runs  down  a  pipe  or  something 
similar  and  accumulates  elsewhere.  Pipes  for  cold  gas  should  be  thermally  insulated.  If  the 
pipes  are  not  very  likely  to  become  cold,  a  foam  cover  might  do. 

All  unusual  events,  no  matter  how  important,  must  be  documented.  This  provides  a 
valuable  early  warning  system  for  weak  spots  of  the  plant  which  might  cause  serious  damage 
one  day  if  not  dealt  with  properly. 


7.2.  Passive  protection  of  the  liquefier 

The  LH2  liquefier  and  the  storage  must  be  located  in  such  a  way  that  there  is  optimum 
protection  from  the  effects  of  accidents  in  other  installations.  Examples  of  the  latter  would 
be  kerosene  storage  and  air  traffic.  The  liquefier  must  be  located  offside  the  runway 
centerlines. 

Safety  distances  for  the  protection  from  accident  effects  elsewhere,  and  the  protection  of 
the  surrounding  area  from  accidents  in  the  plant,  are  demanded  anyway  in  the  building 
regulations  of  most  countries.  The  values  given  are  usually  derived  from  experience  with 
LPG  or  other  hydrocarbon  gases.  This  means  that  they  can  be  considered  as  conservative 
for  hydrogen,  because  the  danger  that  the  gas  may  travel  along  the  ground  to  distant 
ignition  sources  does  not  exist  to  the  same  extent  for  a  hydrogen/air  mixture  than,  for 
example,  a  propane/air  mixture.  This  is  an  important  difference  from  the  point  of  view  of 
safety  engineering  [20,  21,  43]. 

An  additional  safety  possibility  is  the  construction  of  earth  or  other  mounds  to  protect 
the  liquefier  against  flying  debris,  heat  radiation  or  pressure  waves.  Such  structures  can 
also  serve  for  access  restriction. 
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7.3.  Storage  tank  design 

The  tanks  will  almost  certainly  have  double  walls  and  vacuum  insulation.  Various 
alternatives,  together  with  economical  aspects  are  discussed  in  [12],  but  the  result  is  the 
same. 

The  tank  shape  may  be  a  vertical  or  horizontal  cylinder  or  a  sphere.  The  sphere  has  the 
smallest  surface  per  unit  volume,  which  reduces  the  heat  load.  There  is  a  spherical  NASA 
tank  in  Florida  of  3000  m3  LH2.  A  sphere,  however,  is  much  more  difficult  to  manufacture 
than  a  cylinder,  especially  if  it  is  double-walled.  The  free  liquid  surface  in  a  partially  empty 
sphere  is  greater  than  in  a  vertical  cylinder,  which  is  thermodynamically  disadvantageous. 
The  heat  load  advantage  of  a  spherical  tank  and  the  holding  time  will  probably  not  be  the 
key  points  anyway  because  the  liquid  is  not  stored  for  a  long  time.  The  cylinder  tank  will 
probably  be  preferable.  There  is  no  significant  safety  difference  in  the  operation  of  both 
tank  shapes;  there  is,  however,  a  greater  risk  for  production  faults  in  case  of  a  spherical 
tank  because  it  is  more  complicated. 

A  cylindrical  tank  may  be  vertical  or  horizontal,  which  is  no  great  safety  difference  either. 
Most  large  tanks  for  cryogenic  liquids  are  vertical  cylinders  because  of  the  smaller  free 
surface  of  the  liquid  and  the  shorter  line  of  contact  with  the  wall.  Both  factors  reduce  the 
heat  load.  The  final  decision,  however,  must  be  made  under  consideration  of  the  conditions 
on  a  particular  site.  While  an  upright  cylinder  may  need  more  protection  from  flying 
fragments,  it  requires  less  ground  area,  which  is  an  important  boundary  condition  as  well. 

7.4.  Storage  tank  protection 

Risks  for  tanks  containing  flammable  liquids  or  gases  may  be  avoided  by  covering  them 
with  a  layer  of  earth.  This  method  is  recommended  in  Germany  for  LPG  tanks.  Only  the 
face  or  only  the  equipment  of  the  tanks  is  left  accessible.  This  is  a  good  protection  against 
heat  radiation  and  impact  of  flying  debris.  For  tanks  with  cryogenic  content,  however,  the 
matter  is  not  so  easy  because  the  earth  around  the  tank  would  slowly,  but  certainly,  freeze. 
Earth  cover  for  the  tank  must,  therefore,  always  be  accompanied  by  additional  measures 
which  admit  air  to  the  tank  walls. 

Such  schemes  are  discussed  in  [12],  but  are  rejected.  One  reason  is  that  the  ground  water 
on  San  Francisco  airport  is  salty  because  the  site  is  located  directly  at  the  coast.  This  incurs 
additional  costs  for  corrosion  protection.  The  main  reason  is  economy,  not  safety. 

Money  spent  for  safety  is,  of  course,  principally  a  good  investment  when  compared  with 
the  costs  caused  by  mishaps  and  accidents.  While  ground  water  will  be  a  problem  anywhere, 
even  if  it  is  not  salty,  suitable  materials  and  surface  covers  are  known.  Parts,  equipment, 
and  connections  can  be  made  such  that  no  maintenance  is  necessary  during  the  expected 
tank  lifetime.  The  most  important  components  and  equipment  should  be  accessible  anyway. 

An  alternative,  combining  the  advantages  of  earth  cover  with  access  to  the  tank,  would 
be  an  open  dugout  with  concrete  walls  such  that  only  the  top  of  the  tank  would  be  visible, 
but  the  tank  walls  would  be  accessible.  Such  a  dugout  would  need  a  drain  for  rainwater  if 
it  is  open,  and  it  must  be  kept  clean.  Protection  against  the  impact  of  great  fragments  from 
above  (engines,  wheels)  could  be  provided  by  a  suitable  roof,  if  absolutely  necessary.  Such 
a  roof  should  have  openings  for  ventilation. 

7.5.  Storage  tank  distribution 

The  spatial  distribution  of  the  tanks  must  be  decided  on  the  basis  of  the  specific  conditions 
on  the  airport  site.  Certain  safety  distances  are  necessary  from  and  between  the  tanks.  The 
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distance  to  the  liquefier  must  be  an  optimum  between  a  great  safety  distance  and  small 
transfer  losses.  Other  factors  to  be  considered  are  the  ground  area  available  and  the 
direction  from  which  potential  dangers  might  come. 

It  is  not  necessary  to  discuss  the  equipment  of  the  tanks  and  of  the  whole  plant  in  this 
context,  because  it  is  principally  state  of  the  art.  The  requirements  for  the  supply  of  flight 
operations  do  not  introduce  anything  basically  new.  A  storage  of  the  order  of  magnitude 
of  1700  m3  is  certainly  not  common,  but  larger  storage  facilities  exist.  Tanks  of  3600 
m3  geometrical  volume  are  planned  for  the  Euro-Quebec  Hydro-Hydrogen  Pilot  Project 
(EQHHPP)  [36],  with  the  additional  problem  of  suitability  for  sea  transport. 

7.6.  Operation 

The  most  possible  dangerous  situations  are  related  to  the  failure  of  pipes,  connections, 
or  equipment  and  subsequent  hydrogen  release.  The  gas  forms  an  easily  ignitable  mixture 
with  air.  Possible  ignition  sources  must  be  minimized.  Electrical  installations  must  be 
explosion  proof,  metal  structures  must  be  grounded,  and  open  fire  (smoking)  must  be 
forbidden.  Motor  vehicles  or  comparable  machines  (including  e.g.  lawn  cutters)  must  not 
operate  in  and  around  the  plant  or  only  under  safety  restrictions  and  conditions.  All  these 
rules  follow  from  the  usual  regulations  for  work  protection  and  prevention  of  accidents 
like,  for  example,  in  Germany  [44]. 

Similar  precautions  must  be  taken  to  prevent  the  formation  of  an  ignitable  mixture  inside 
a  duct  or  tank. 

7.7.  Fuel  distribution  line 

The  hydrogen  will  be  distributed  by  means  of  a  long  ring  pipeline  of  which  most  parts 
will  not  be  under  continuous  personal  supervision.  The  risks  associated  with  it  are  not  the 
same  as  in  the  case  of  the  liquefier. 

It  goes  without  saying  that  such  a  pipeline  must  be  below  ground  level.  If  it  is  installed 
in  a  closed  tunnel,  a  sufficient  number  of  independent  gas  alarms  is  necessary.  Damage  to 
the  liquid  lines  would  soon  be  noticed  because  of  the  loss  of  the  insulating  vacuum. 

The  San  Francisco  study  [12]  proposed  an  open  trench  covered  with  grids.  This  would 
permit  the  escape  of  released  hydrogen.  The  lines  could  be  provided  with  a  thin  metal  cover 
fitted  with  gas  alarm  on  the  inner  side.  The  cover  would  not  have  to  be  tight  or  heavy, 
because  it  should  be  easy  to  open  for  maintenance.  Valves  and  other  equipment  could  also 
fit  under  this  cover. 

Care  must  be  taken  to  avoid  the  accumulation  of  kerosene  or  other  flammable  material 
(leaves),  rainwater  or  anything  else  in  the  trench.  Ground  contaminated  by  kerosene  spills 
should  not  be  able  to  pose  a  risk  to  the  trench. 

7.8.  Miscellaneous 

The  plant  and  its  periphery  will  have  to  be  equipped  with  safety  provisions  similar  to 
those  for  chemical  plants  or  gas  storage.  Many  requirements  will  be  derived,  at  least 
analogously,  from  the  regulations  mentioned  earlier  applying  to  the  latter.  Even  if  not 
formally  applicable,  the  content  will  be  similar;  it  will  certainly  not  be  on  a  lower  level. 

Gas  alarm  devices  and  other  alarms  are  important.  Venting  must  be  provided  at  places 
where  hydrogen  will  or  could  escape.  These  precautions  must  be  made  according  to  the 
state  of  the  art  and  not  necessarily  only  according  to  the  regulations. 

Grounding  of  plant  parts  wherever  necessary  is  an  essential  safety  precaution.  This 


254 


U.  SCHMIDTCHEN  et  ai 


applies  not  only  to  the  liquefaction  plant,  but  even  more  to  the  planes  whose  charge  depends 
on  flight  and  landing  history.  Grounding  must,  therefore,  be  a  basic  requirement  for  tank 
and  maintenance  procedures. 

A  well  organized  control  and  maintenance  schedule  is  a  very  good  measure  against  plant 
failures  and  accidents,  provided  care  is  taken  to  follow  it. 


8.  AIRPORT  EMERGENCY  MEASURES 


8.1.  General 

There  is  a  high  safety  level  on  an  airport  anyway,  from  which  hydrogen  facilities  will 
profit.  There  is,  for  example,  a  fire  brigade  which  would  have  to  be  trained  for  the  dangers 
associated  with  hydrogen.  Experience  should  be  exchanged  between  airports  and  with  the 
industry,  if  possible  by  means  of  an  institution. 

Care  for  the  most  dangerous  and  the  most  likely  situations  must  be  taken  by  means  of  a 
detailed  plan  which  is  designed  in  cooperation  with  the  relevant  city  and  other  authorities. 
This  is  usually  required  by  environmental  legislation  anyway. 

8.2.  Modular  plant  design 

The  most  likely  accident  is  the  release  and  dispersion  of  hydrogen  gas.  How  to  avoid  this 
has  already  been  discussed.  If  it  happens,  the  extent  of  the  spill  must  be  limited  by  inter- 
rupting  the  connections  between  the  plant  parts,  to  the  tanks,  or  between  them,  depending 
on  where  exactly  the  release  happens.  There  must  also  be  provisions  for  the  emergency  cut¬ 
off  of  the  various  pipeline  segments  and  the  tank  positions,  as  well  as  other  comparable 
elements.  Even  the  whole  liquefier  plant  should  have  the  possibility  to  interrupt  the  con¬ 
nection  to  the  airfield  in  order  to  prevent  undesirable  effects  in  either  direction. 

8.3.  Recognition  of  leaks  and  fires 

Hydrogen  has  neither  colour  nor  odour.  A  hydrogen  flame  radiates  mainly  in  near  UV 
light,  which  means  that  it  is  almost  invisible.  This  is  a  safety  problem  because  an  escape  or, 
more  seriously,  a  fire  must  be  recognized  as  quickly  as  possible.  Gas  alarms  at  suitable 
places  (in  buildings  and  under  roofs)  have  been  mentioned  already. 

Gases  can  be  mixed  with  an  odorizing  agent  or  one  that  gives  a  characteristic  colour  to 
the  flame.  This  cannot  be  done  at  20  K  because  all  additives  would  solidify,  get  into  the 
tanks,  and  interfere  with  the  valves  and  pumps.  More  suitable  would  be  paints  and  covers 
for  pipes  and  tanks  which  change  colour  when  heated.  Such  systems  have  been  proposed 
for  acetylene  cylinders  to  make  the  progress  of  a  decay  visible. 

Alternatively,  paints  could  be  used  which  react  with  hydrogen  in  a  harmless,  but  charac¬ 
teristic  way  or  which  catalyze  such  a  reaction.  The  advantage  would  be  that  the  escape  of 
gas  could  be  detected  sooner,  independent  of  an  ignition. 

The  airport  could  be  controlled  automatically  for  hydrogen  fires  by  an  optical  device 
located  on  the  roof  of  the  tower  or  another  suitable  place.  The  characteristic  combination 
of  the  spectral  emission  of  hydrogen  with  the  flame  temperature  should  make  it  easy  to 
distinguish  such  a  flame  from  e.g.  a  hot  engine. 

8.4.  Fire 

Escaped  hydrogen  is  easily  ignitable.  All  vent  and  relief  lines  should,  therefore,  be 
equipped  with  a  flame  arrestor  if  there  is  a  chance  that  a  flame  may  enter  them  and  cause 
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damage  somewhere  in  the  system.  This  may  not  be  necessary  as  long  as  a  sufficient  amount 
of  hydrogen  flows  through  the  line.  However,  an  open  safety  valve  vent  line  for  example  is 
normally  not  used,  or  only  occasionally,  and  will  contain  oxygen.  All  lines  from  which 
hydrogen  might  be  released  should  be  arranged  in  such  a  way  that  the  gas  discharge  will 
not  create  new  risks.  Weather  conditions  must  be  taken  into  account. 

The  extended  use  of  hydrogen  fire  extinction  devices  is  unsuitable.  The  best  method  is  to 
interrupt  the  hydrogen  supply  to  the  flame  by  means  of  the  modular  design  mentioned 
earlier  and  to  let  the  gas  in  the  line  burn  off.  If  only  the  flame  is  extinguished  without 
interrupting  the  gas  supply,  gas  can  escape  without  burning,  and  the  resulting  ignitable 
cloud  may  be  a  greater  danger  than  the  flame. 

9.  AIRCRAFT  DESIGN 

9.1 .  Amount  and  phase  of  hydrogen  on  board 

Design  studies  in  the  scope  of  the  Cryoplane  project  are  based  on  a  modification  of  the 
twin-engined  Airbus  A3 10.  A  range  comparable  to  that  of  a  kerosene  aircraft  is  achieved 
by  a  fuel  supply  of  about  15  t  or  200  m3  LH2.  The  fuel  consumption  will  be  between  1700 
g/s  (24  1/s)  LH2  during  take-off  and  530  g/s  (7.5  1/s)  in  cruise  [1 1]. 

The  proposal  has  been  discussed  to  use  hydrogen  slush  (a  mixture  of  liquid  and  solid) 
instead  of  the  liquid.  The  tanks  would  be  smaller  and  hold  the  fuel  for  a  longer  time  in  the 
liquid  condition.  However,  the  pressure  in  the  tanks  would  be  subatmospheric  because 
slush  exists  only  at  the  triple  point,  which  has  an  absolute  pressure  of  7000  Pa  in  the  case 
of  hydrogen;  this  would  facilitate  air  ingress  into  the  tank  and  the  lines  in  case  of  a  leak. 
While  slush  with  a  solid  content  of  up  to  50  %  is  known  to  flow  through  tubes  without 
problems,  solid  particles  may  interfere  with  valve  or  pump  performance  or  support  plugging 
at  an  elbow  of  the  tube.  Holding  time  is  not  the  important  thing  anyway  because  the  fuel 
of  an  aircraft  will  soon  be  consumed.  The  idea  of  using  slush  was,  therefore,  abandoned. 

9.2.  Tanks ,  tank  shape ,  tank  distribution ,  and  fuelling  connections 

There  are  various  reasons  why  the  fuel  should  be  distributed  to  more  than  one  tank.  The 
exact  number  and  location  of  the  tanks  was  discussed  at  length,  but  there  was  agreement 
about  the  arrangement  of  the  tanks  on  top  of  the  fuselage  as  shown  in  Figs  7-9  [11].  There 
will  be  an  aerodynamic  shroud  so  that  the  observer  will  just  see  a  fuselage  of  somewhat 
uncommon  height.  The  safety  advantages  of  this  concept  will  be  discussed  below. 
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Fig.  7.  Cryoplane  tank  arrangement,  side  view. 
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Fig.  8.  Cryoplane  tank  arrangement,  top  view. 


Fig.  9.  Cryoplane  tank  arrangement,  front  view. 


According  to  the  present  design  status  the  fuel  will  be  evenly  distributed  on  two  groups 
of  tanks,  consisting  of  a  large  and  a  small  one  each.  This  is  the  design  presented  in  Figs  7- 
9.  Since  the  large  tank  will  have  twice  the  volume  of  the  small  one,  the  small  tank  will 
accommodate  about  2400  kg  or  35  m3  of  LIT.  Each  group  will  supply  one  engine  in  normal 
operation.  The  valve  arrangement,  however,  allows  also  for  other  supply  patterns. 

The  operating  pressure  of  the  tanks  will  be  between  0.12  and  0.16  MPa  with  a  nominal 
value  of  (0.14  +  0.02)  MPa.  The  test  pressure  wall  be  0.21  MPa  and  the  burst  pressure  0.32 
MPa  [11]. 

The  tank  shape  is  still  under  discussion.  The  circular  cross  section  w'ould  principally  be 
the  best  solution  because  it  minimizes  the  tension  in  the  tank  wall  and  increases  reliability 
and  life  expectancy.  It  is  known  both  theoretically  and  from  accident  experience  [5]  that 
deviations  from  the  circular  shape  favour  material  fatigue.  Also  discussed,  however,  is  a 
crescent  shaped  tank  with  a  lower  profile,  which  would  mean  an  aerodynamic  advantage. 
Fig.  10  [11]  compares  both  shapes.  The  behaviour  after  long  service  life  cannot  be  judged 
on  the  basis  of  the  present  knowledge.  Differences  regarding  safety  aspects  between  both 
shapes  are  negligible. 

The  heat  budget  is  affected  by  the  fact  that  the  liquid  will  slosh  in  certain  flight  situations 
(take-off,  turns)  and  will  make  contact  with  warmer  parts  of  the  tank  wall;  this  increases 
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Fig.  10.  Cryoplane  fuselage  with  circular  or  crescent  shaped  tanks  on  top. 


the  vaporization  rate.  The  temperature  difference  between  tank  top  and  liquid  in  a  partly 
filled  tank  can  be  considerable  because  the  gas  is  a  poor  heat  conductor  in  comparison  with 
the  liquid. 


10.  AIRCRAFT  RISKS 

The  in-flight  risks  to  aircraft  and  passengers  must  be  dealt  with  as  far  as  possible  by  the 
design  and  by  passive  means  because  help  from  outside  is  not  available.  A  high-risk 
component  is  the  engine  with  its  many  fast  moving  parts.  The  breaking  of  a  rotor  blade  in 
flight  is  dangerous  because  fragments  may  hit  a  tank  or  interrupt  a  fuel  line. 

One  of  the  most  important  dangerous  situations  in  flight,  as  well  as  for  the  airport,  is  the 
uncontrolled  escape  of  hydrogen.  This  may  be  gas  or  liquid,  and  it  may  be  a  large  outbreak 
as  well  as  a  stealthy  escape.  For  the  case  of  a  release  at  high  rates  it  should  be  checked 
which  steering  devices  or  similar  components  close  to  the  leak  might  be  affected.  Damage 
can  be  done  by  mechanical  impact,  cooling  and  ice  formation,  or  fracture  due  to  loss  of 
elasticity  by  cooling. 

A  crash  landing  is  a  dangerous  situation  with  a  certain  probability.  It  should,  of  course, 
be  avoided.  But  it  is  equally  important  to  limit  the  potential  damage  in  case  it  occurs.  The 
greatest  damage  is  frequently  done  not  by  the  crash  itself  but  in  the  later  stages  of  the  event. 


11.  PREVENTION  OF  FLIGHT  ACCIDENTS 


11.1.  Generally 

Statistical  data  about  flight  accidents  show  that  only  about  1/6  of  accidents  with  known 
reasons  are  caused  by  deficiencies  of  the  aircraft,  while  2/3  are  related  to  the  crew  [45],  The 
role  of  technical  means  in  reducing  this  number  can  be  to  do  routine  work  and  permit  the 
pilot  to  concentrate  on  the  really  important  things.  One  step  in  this  direction  may  be  seen 
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in  the  fly-by-wire  concept  introduced  recently.  Such  devices  are  particularly  important  with 
the  new  risks  related  to  the  Cryoplane  in  view. 

Safe  design  and  passive  devices  are  the  best  means  against  in-flight  problems.  There  is, 
however,  not  much  experience  with  cryogenic  systems  with  a  very  long  operational  life. 
This  is  a  field  which  requires  more  research  and  development. 

1 1 .2.  Topics  to  be  considered 

Safety  relevant  problems  in  connection  with  the  design  and  operation  of  the  tanks  are 
for  example: 

•  How  does  the  liquid  distribution  vary  during  the  flight?  Which  tank  will  be  filled  to  which 
extent  during  which  flight  phase,  and  why? 

•  Which  protection  does  the  tank  design  offer  against  internal  and  external  pressure,  heat, 
or  external  force? 

•  Are  the  lines  between  tank  and  engine,  the  equipment,  the  safety  devices,  and  the  whole 
accessory  suitable  for  their  purpose?  Who  approves  them,  and  on  what  basis? 

•  Is  it  meaningful  to  make  the  fuel  lines  from  the  tanks  to  the  engines  redundant? 

•  Which  auxiliary  and  other  devices  are  located  near  the  tanks,  and  which  means  of 
operation,  except  hydrogen,  are  necessary  for  them? 

•  How  tight  and  mechanically  resistant  is  the  separation  between  tank  space  and  passenger 
compartment? 

Some  of  these  items  will  be  discussed  below,  though  final  answers  can  generally  not  be 
given  at  this  stage.  They  will  depend  not  only  on  safety,  but  also  on  other  technical  and 
economical  considerations. 

11.3.  Materials 

All  safety  relevant  data  of  the  chosen  materials  of  all  components  (including  equipment) 
must  be  known  for  the  whole  range  of  operating  temperatures.  While  this  may  not  be  a  great 
problem  for  low-temperature  steels,  the  situation  is  not  always  satisfactory  for  advanced 
materials  for  aircraft  and  spacecraft,  for  example,  the  aluminium-lithium  alloy  “Weldalite”, 
which  is  one  of  the  favourite  aerospace  materials.  This  is  particularly  true  for  the  behaviour 
after  long  service  life  and  under  the  influence  of  hydrogen.  A  Cryoplane,  unlike  a  space 
rocket,  will  have  to  operate  reliably  for  years. 

Aluminium  is  of  course  not  as  heavy  as  steel,  which  explains  its  preferred  use  for  aerospace 
purposes.  While  this  may  be  an  economical  advantage  for  normal  operation,  there  are  also 
safety  matters  to  be  considered.  Aluminium  offers  significantly  less  resistance  against  flames 
and  heat  than  steel. 

1 1 .4.  Tanks 

Double-walled  tanks  with  additional  heat  insulation  have  a  certain  mechanical  stability 
anyway.  How  far  they  can  resist  to  external  force  under  specific  conditions  must  be  studied 
experimentally.  Safe  design  of  the  tanks  and  their  equipment  are  a  key  matter  for  the 
prevention  of  accidents. 

Pressure  vessels  are  designed  according  to  the  “leak  before  break”  principle,  which  means 
that  in  case  of  a  failure  the  vessel  should  not  burst  into  fragments  catastrophically,  but  rip 
open  at  one  point  and  let  the  gas  escape.  The  release  is  a  bit  slower,  and  protective  measures 
can  be  taken.  This  principle  should  be  used  in  aerospace  applications  as  well. 
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Even  in  the  absence  of  suspicious  observations  the  presence  of  hydrogen  in  the  tank 
space  should  always  be  assumed.  Gas  alarms  should  be  there  to  alert  the  crew.  Inertisation, 
at  least  partly,  can  be  initiated  automatically.  The  tank  cover  might  be  designed  in  such  a 
way  that  ventilation  is  done  in  any  case.  This  permits  disposal  of  small  amounts  of  gas 
without  danger. 

In  case  of  insulation  loss  by  an  accident  or  handling  error,  the  vaporization  rate  and  the 
pressure  in  the  tanks  increase  drastically.  This  means  that,  if  the  tanks  are  vacuum  insulated, 
there  should  only  be  as  many  vacuum  handling  components  as  absolutely  necessary,  and 
they  should  not  be  accessible  without  special  tools  and  procedures.  Nobody  should  have  a 
chance  to  tamper  with  it  unless  the  aircraft  is  in  a  special  maintenance  facility.  Similar 
precautions  should  be  taken  for  any  other  type  of  insulation. 

The  mechanical  load  on  the  tank  in  normal  operation  is  low  and  fairly  constant.  The 
thermal  load,  however,  may  oscillate  considerably  around  the  average  value  given  by  the 
temperature  difference  and  the  quality  of  the  insulation.  It  is  known  [46]  that  vibration  at 
a  frequency  of  a  few  Hz  enhances  vaporization;  whether  this  effect  is  also  important  for 
high  frequencies  (engine  rotation)  remains  to  be  seen. 

There  will  be  a  gap  between  the  tanks  in  the  rotation  plane  of  the  engine  blades  (see  Fig. 
7)  to  make  sure  that  fragments  do  not  hit  a  tank  in  case  they  break.  What  remains  a  risk 
in  this  case  is  a  damage  to  the  fuel  lines.  They  must  be  suitably  protected  if  their  presence 
in  this  region  cannot  be  avoided. 

Safety  relevant  control  and  display  devices  should  be  separated  from  the  tank  to  ensure 
their  function  in  case  of  tank  problems.  Signal  transmission  to  the  crew  should  be  as  fail¬ 
safe  as  possible. 

11.5.  Valves  and  equipment 

Experience  with  valve  behaviour  from  ground  and  space  operation  cannot  simply  be 
adopted  for  aircraft  service.  Space  missions  are  very  short  in  comparison  with  the  service 
life  of  an  aircraft,  and  ordinary  plants  have  other  operating  conditions  than  an  aircraft. 
This  means  that  a  type  test  as  well  as  an  individual  test  of  all  components  must  be  made 
with  low  temperature  service  for  long  periods  in  mind.  Most  plant  failures  due  to  technical 
reasons  are  caused  by  the  failure  or  malfunction  of  some  part  of  the  equipment. 

Type  test  programs  of  components  should  be  done  by  a  competent  and  independent 
organization  like  BAM  or  those  which  play  a  role  in  quality  assurance  systems  according 
to  ISO  9000  or  EN  45000.  One  key  element  of  the  test  sequence  should  be  the  simulation 
of  the  most  unfavourable  operational  conditions,  in  particular  rapid  temperature  changes. 
Another  key  element  must  be  endurance  tests  under  realistic  conditions  with  a  number  of 
operational  cycles  depending  on  the  expectations  for  service,  combined  with  artificial 
ageing.  Several  samples  or  groups  of  samples  should  undergo  the  program  in  different 
sequences;  BAM  experience  shows,  for  example,  that  it  makes  a  great  difference  whether  a 
valve  is  tested  under  high  temperatures  after  a  cold  test  or  vice  versa. 

The  principles  outlined  for  valves  hold  for  equipment  and  measuring  devices  of  all  types. 

11.6.  Internal  fuel  transfer 

Transfer  of  cryogenic  liquids  should  be  avoided  as  far  as  possible  for  thermodynamic 
and  safety  reasons.  Some  common  designs  can  or  should  not  be  used  for  a  Cryoplane. 
Conventional  aircraft  redistribute  the  fuel  during  the  flight  between  the  tanks  to  improve 
the  balance;  some  (like  Airbus  A3 10  ER)  even  use  a  tank  in  the  tail  fin  for  this  purpose. 
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This  is  not  useful  for  a  Cryoplane  because  the  transfer  of  LH2  inevitably  leads  to  losses, 
which  would  also  be  higher  over  long  distances  if  the  latter  system  was  used. 

Bubbles  in  the  fuel  lines  should  be  avoided  by  all  means  because  they  affect  the  engine 
performance.  Subcooling  of  the  liquid  (pressure  rise  above  vapour  pressure)  by  means  of  a 
pump  has  been  proposed,  but  this  question  requires  further  research. 


11.7.  Pumps 

The  fuel  transfer  from  the  active  tank  to  the  engine  is  intended  to  be  done  by  means  of 
pumps.  The  same  holds  for  the  refilling  of  the  active  from  the  passive  tank,  while  originally 
the  use  of  overpressure  was  considered  [11].  This,  too,  is  a  field  for  more  development  work. 
While  there  are  proven  fuel  transfer  systems  in  space  service,  their  service  life  is  usually 
rather  short  (about  10  min  for  a  first  stage,  a  few  hours  for  a  third  stage).  Satellite 
cryosystems  with  a  long  service  life  (between  a  few  weeks  and  a  year)  avoid  cryogen  transfer 
completely  and  cool  by  contact  or  conduction.  As  far  as  liquid  or  gas  must  be  transferred, 
passive  systems  are  preferred  which  use  the  particular  properties  of  the  cryogen,  as  in  the 
case  of  Helium  II  [47,  48]. 

Murphy's  law  tells  us  that  pumps  may  and  will  fail;  even  their  normal  operation  incurs 
thermal  losses.  This  may  make  the  transfer  by  means  of  pressure  differences  appear  attract¬ 
ive,  but  this  procedure  is  associated  with  losses  of  its  own  [49],  as  well  as  the  liquid 
withdrawal  under  vapour  pressure  equilibrium.  Pressure  differences  must  be  there  before 
they  can  be  used,  and  this  requires  auxiliary  equipment  (pumps,  heat  exchangers)  which 
have  risks  of  their  own. 

Suitable  pump  types  or  principles  must  be  identified  and  optimized  or  developed.  Cen¬ 
trifugal  pumps  have  been  proposed  for  the  LH2  transfer  between  the  Cryoplane  tank  and 
the  engines  [11].  The  key  matter  will  be  reliability  for  extended  cryogenic  service  and 
protection  against  explosions.  Three  pumps  are  foreseen  for  each  tank  for  redundancy 
reasons.  Each  individual  pump  should  have  a  fail-safe  design  such  that  even  in  case  of  a 
failure  it  can  be  shut  dowm  without  additional  risks. 

Most  pumps  comprise  moving  parts  which  give  rise  to  friction  problems;  these  are  mainly 
unsettled  for  the  environment  discussed  here.  The  matter  is  important,  however,  both  for 
normal  operation  and  for  failure.  More  intensive  tribological  investigations  of  important 
material  combinations  are  therefore  necessary. 


11.8.  Piping 

While  the  tanks  will  have  an  elaborate  thermal  insulation,  the  insulation  for  fuel  lines 
may  be  of  lower  quality  because  the  liquid  will  not  remain  in  them  for  long.  This  reason, 
however,  does  not  necessarily  apply  to  the  internal  connections  between  the  tanks.  Double- 
walled  lines  with  vacuum  and  superinsulation  have  safety  advantages  because  they  offer  a 
higher  mechanical  stability.  Monitoring  of  the  insulation  vacuum  permits  continuous  leak 
control  of  tubes  and  connections  and  automatic  initiation  of  countermeasures  in  case  of  a 
failure.  These  measures  could  be  taken  completely  passively  by  making  use  of  the  pressure 
differences  in  the  system  or  their  disappearance  (there  are  systems  like  this  for  flexible  LPG 
hoses).  Undetected  leakage  plays  an  important  role  in  accidents  [50].  While  the  control  for 
leaks  will  mainly  be  done  by  gas  detectors,  there  may  be  some  isolated  and  gas-tight 
compartments  w;here  pressure  sensors  could  do  the  same  job. 

The  fuel  lines  in  the  wings  and  the  interface  between  fuselage  and  wings  are  particularly 


Hydrogen  aircraft  and  airport  safety 


261 


vulnerable  in  case  of  damage  from  outside.  Care  must  be  taken  when  the  exact  location  of 
the  fuel  lines  in  this  area  is  considered. 

11.9.  Fuelling  and  other  connections 

Fuelling  of  the  aircraft  provides  a  certain  risk,  as  experience  from  spacecraft  shows  [51]. 
Mistakes  may  and  will  occur.  They  should  be  prevented  by  suitable  training  of  personnel 
and  by  constructive  measures.  Connecting  and  disconnecting  the  fuel  line  to  the  aircraft 
should  be  easy,  and  hydrogen  flow  must  be  impossible  unless  the  connection  is  in  its  correct 
state.  The  construction  of  the  connections  should  be  such  that  helium  purging  is  not 
necessary,  because  (unlike  hydrogen)  helium  is  a  resource  of  limited  supply;  such  systems 
exist  for  surface  vehicles  [52].  The  potential  for  human  failure  must  be  reduced  wherever 
possible  by  the  use  of  automatic  and,  if  possible,  passive  systems. 

While  make-and-break  connections  are  of  course  necessary  for  fuelling  purposes,  they 
are  generally  a  risk  and  should  be  avoided  wherever  possible  in  favour  of  welded  or  other 
static  connections.  These,  too,  are  weak  spots,  and  their  number  should  be  minimized.  This 
requirement  is  already  contained  in  the  general  ideas  for  safe  aircraft  design. 

11.10.  Operation 

Since  most  accidents  happen  due  to  human  error,  the  safety  level  can  be  improved  when 
errors  can  be  avoided  by  technical  means  or  suitable  operation  procedures.  While  safety  is 
a  key  matter  in  aviation  anyway,  additional  care  must  be  taken  in  the  case  of  Cryoplane  to 
avoid  the  unwanted  occurrence  of  flammable  hydrogen/air  mixtures.  The  start  and  shut¬ 
down  procedures  for  the  engines  require  special  attention  because  an  ignition  is  part  of 
their  normal  operation.  Hydrogen  should  have  no  chance  to  leave  the  fuel  line  prematurely, 
or  it  should  at  least  be  introduced  into  an  inertized  space. 

Routine  maintenance  should  be  possible  while  the  tank  is  cold.  The  filling  of  even  a  cold 
tank  with  cryogenic  liquids  requires  a  lot  of  time,  as  is  known  from  motorcars  [37],  otherwise 
losses  are  incurred.  Optimized  quick  and  safe  procedures  must  be  developed.  While  LH2 
tank  couplings  are  principally  state  of  the  art  (Johnston  couplings),  they  must  be  improved 
for  higher  flow  rates. 


12.  FLIGHT  EMERGENCY  MEASURES 

12.1.  Emergency  situations 

In-flight  problems  may  be  uncomplicated  such  that  they  can  be  dealt  with  by  the  means 
available  on  board  and  the  flight  can  be  completed  normally;  maintenance  or  repair  can  be 
done  later.  Others  may  affect  the  safety  of  the  aircraft;  in  this  case  the  pilot  will  usually  try 
to  land  on  the  nearest  airfield. 

A  crash  landing  is  possible  if  the  handling  of  the  aircraft  is  affected.  Most  crash  landings 
happen  on  or  near  airports  so  that  the  fire  brigade  can  help.  The  same  holds  for  most  other 
problems,  because  about  21  %  of  all  incidents  occur  during  the  final  approach  and  27  % 
during  landing  [45]. 

Hydrogen  is  by  its  very  nature  safer  than  LNG  or  kerosene  [25].  Unlike  these,  it  does 
not  create  pools  around  the  crash  site  which  remain  there  for  a  long  time,  catch  fire  and 
prevent  escape  or  help.  Neither  does  hydrogen  form  flammable  clouds  which  creep  on  the 
ground  around  the  aircraft.  Hydrogen  disappears  quickly  because  of  its  low  density,  as 
experience  by  BAM  [21]  and  elsewhere  has  shown  repeatedly.  The  formation  of  great  clouds 
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is  unlikely  because  it  ignites  easily.  Hydrogen  burns  quickly  under  low  heat  emission,  as  it 
has  been  shown  earlier. 

12.2.  Tanks 

An  aircraft  with  the  tanks  on  top  of  the  fuselage  is  safer  than  a  conventional  one  because 
the  tanks  do  not  have  ground  contact  at  once  if  the  gear  is  up  during  landing.  The  loss  of 
a  wing  does  not  necessarily  mean  the  loss  or  destruction  of  a  tank. 

The  tanks  might  be  fastened  on  the  fuselage  in  such  a  way  that  they  can  be  dropped 
when  necessary;  the  cover  must  not  obstruct  such  a  process.  The  break  points  in  the  lines 
between  the  tanks  and  to  the  engines  must  be  planned  carefully,  also  the  release  procedure. 
An  automatic  release  is  not  recommended  because  such  provisions  may  work  when  they 
should  not  or  vice  versa,  in  particular  under  uncommon  conditions  like  in  an  accident  (see 
the  recent  accident  of  a  Lufthansa  Airbus  at  Warsaw).  The  tank  must  be  deployed  far 
enough  from  the  aircraft  without  jeopardizing  it. 

12.3.  Valves 

The  loss  of  an  engine  will  leave  the  fuel  lines  wide  open.  Passive  excess  flow  valves  are 
recommended  for  this  purpose  to  interrupt  the  flow  from  the  tanks.  This  would  also  help 
if  a  wing  is  lost  during  a  crash  landing  after  a  collision  with  an  obstacle.  While  these  devices 
are  not  completely  tight,  they  are  at  least  able  to  restrict  the  fuel  loss  until  the  complete 
interruption  of  the  affected  line  can  be  done  by  the  crew. 

Safety  valves  must  be  type  tested  for  their  reliability  at  low  temperatures.  A  critical  point 
is  their  prompt  release  after  not  having  been  used  for  a  long  time,  because  they  have  a 
tendency  to  stick.  Equally  important  is  their  closing  after  the  release  of  large  amounts  of 
cold  gas.  These  problems  are  common  to  all  types  of  cryogenic  installations. 

Burst  disks  can  be  used  alternatively  to  safety  valves  in  certain  places.  They  are  tighter 
than  valves,  but  cannot  be  closed  again.  They  must  be  chosen  under  the  aspect  that  the 
burst  pressure  must  remain  the  same  at  all  operating  temperatures.  Some  applications  use 
a  combination  of  safety  valve  and  burst  disk. 

12.4.  Piping 

A  suitable  arrangement  of  lines  and  equipment  can  prevent  many  dangerous  situations 
from  the  very  beginning.  There  should  be  provisions  to  isolate  important  pipe  segments 
from  the  rest,  similar  to  the  modular  concept  of  the  airport  plant.  This  may  be  useful  not 
only  for  a  massive  hydrogen  loss,  but  also  for  a  discharge  at  small  rates,  because  cutting 
off  the  damaged  element  from  the  tanks  would  give  the  crew  more  time  to  land  the  aircraft 
safely. 

12.5.  Gas  venting 

Gas  which  is  discharged  by  a  safety  valve  or  a  burst  disk  should  be  vented  without 
creating  additional  dangers  by  the  flow  of  discharged  gas.  Small  amounts  could  be  collected 
in  a  special  tanks,  but  provisions  for  venting  outside  must  exist. 

Reference  [12]  and  other  studies  propose  a  venting  line  which  ends  at  the  highest  point 
of  the  aircraft  in  the  tail  fin.  This  is  the  logical  position.  The  presence  of  oxygen  there 
requires  special  attention  to  prevent  its  ingress  into  the  hydrogen  system.  This  can  be  done 
by  back  pressure  valves  which  discharge  hydrogen  only  when  it  is  under  a  certain  minimum 
pressure. 
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Venting  of  hydrogen  into  air  creates  an  ignitable  mixture.  The  ignition  risk  can  be  reduced 
by  suitable  design  of  the  opening  of  the  vent  gas  line,  for  example  by  reducing  the  speed  of 
the  gas  flow.  A  flame  arrestor  should  be  provided  by  any  means. 

12.6.  Fire 

Fuel  fires  after  a  crash  are  an  important  risk.  Statistical  data  [45]  show  that  between  10 
and  20  %  of  accident  victims  die  in  a  fire  after  they  have  survived  a  crash  or  collision. 
Substances  other  than  the  fuel,  like  the  tank  insulat  ion,  can  also  burn  and  generate  danger- 
ous  gases  or  smoke.  If  such  dangers  cannot  be  avoided  at  all  by  suitable  choice  of  materials, 
passengers  should  at  least  have  a  chance  for  escape  before  being  exposed  to  them. 

The  interface  between  the  passenger  compartment  and  tank  space  plays  an  important 
role  in  the  protection  from  a  hydrogen  fire.  Suitable  design  does  not  necessarily  mean  that 
it  must  be  heavy;  it  might  be  provided  with  a  protective  paint  which  reacts  endothermally 
in  case  of  a  fire.  Such  paints  are  state  of  the  art  for  LPG  tanks,  and  their  performance  has 
been  tested  with  positive  results  [53,  54].  They  might  prolong  the  escape  chance  of  the 
passengers  by  a  few  precious  minutes.  A  fire  can,  of  course,  start  in  the  passenger  cell  as 
well  and  affect  the  tanks.  The  heat  load  may  be  lower,  but  the  protection  of  the  fuselage 
against  heat  will  probably  on  a  lower  level  on  this  side. 


13.  TOPICS  REQUIRING  FURTHER  INVESTIGATION 

13.1.  Effects  of  the  airport  plant  size 

While  gas  liquefaction  plants  are  state  of  the  art,  the  dimension  discussed  here  is  certainly 
not.  There  will  be  technical  problems  which  cannot  be  solved  by  simple  extrapolation 
of  present  experience.  Another  important  point  is  that  certain  components  for  the  LH2 
distribution  are  not  available  at  the  present  time,  at  least  not  in  the  dimensions  required 
for  this  purpose. 

Plant  design  will  certainly  benefit  from  the  experience  of  space  centres.  While  the  data 
from  Florida  and  Kourou  is  comparatively  easy  to  get,  this  was  very  difficult  for  the  USSR 
space  program.  The  situation  has  improved  considerably  meanwhile,  also  due  to  the  Russian 
contribution  to  Cryoplane. 

13.2.  Release  of  large  am o un  ts  of  LH2 

Accidents  in  a  liquefaction  plant  of  the  size  in  question  may  involve  the  release  of  fairly 
large  amounts  of  hydrogen,  either  liquid  or  gaseous.  The  behaviour  of  such  amounts 
under  instantaneous  or  continuous  release  rates  is  not  completely  clear  because  previous 
experiments  dealt  usually  with  much  smaller  amounts.  The  NASA  experiments  in  1980  [28, 
29]  used  amounts  up  to  6  m3  liquid  with  release  times  of  30  s  or  less.  The  Arthur  D,  Little 
experiments  [27]  involved  no  more  than  19  m?.  The  BAM  experiments  in  1994  [20,  21] 
released  about  0.7  m3  during  1  min.  The  discharge  behaviour  of  large  amounts  and  large 
rates  of  liquid  and  cold  gas,  pool  formation,  vaporization,  gas  mixture  dispersion,  and 
ignition  effects  should  be  investigated  to  a  greater  extent.  Parameters  should  be  weather 
and  ground  conditions  and  the  location  and  nature  of  igniters.  Not  settled  is  the  issue 
whether  a  suitably  great  free  cloud  can  detonate.  There  is  a  lack  of  reproducible,  well- 
documented  observations. 

These  matters  are  even  more  important  in  connection  with  aircraft  accidents.  While  240 
m3  or  17  t  are  not  much  in  comparison  to  the  plant  inventory,  it  is  much  more  than  in 
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known  experiments.  There  is  a  greater  release  risk  in  crashes  and  collisions,  and  more 
people  can  be  affected. 

While  the  effects  from  releases  at  smaller  rates  have  been  investigated  before,  the  influence 
of  buildings  or  industrial  installations  on  the  dispersion  tends  to  make  predictions  difficult. 

13.3.  Materials 

The  behaviour  of  materials  and  components  under  the  combined  effect  of  cyclic  pressure 
load  and  hydrogen  is  an  important  topic.  Cyclic  loads  with  low  frequency  are  not  well 
investigated.  Nobody  knows  whether  the  phenomena  occurring  then  are  qualitatively 
different  from  those  at  higher  frequencies  which  are  common  in  laboratory  tests.  Also 
important  is  the  resonance  behaviour  of  the  tanks  and  the  other  components. 

Ft  goes  without  saying  that  all  material  properties  must  be  known  for  the  whole  range  of 
temperatures.  This  is  not  always  the  case  at  this  time,  particularly  for  some  interesting 
aluminium  alloys. 

13.4.  Storage  tank  performance 

The  tank  performance  must  be  investigated  comprehensively.  This  is  of  particular  import¬ 
ance  when  they  are  to  be  built  in  great  numbers.  Tests  should  include  simulations  of  the 
normal  operation,  in  particular  w'ith  a  view  on  material  fatigue  under  cyclic  load  and 
unfavourable  combinations  of  operational  conditions  and  their  changes.  Another  matter  is 
the  risk  associated  with  the  tanks  in  plant  accidents.  Damaging  the  tanks  by  means  of  fire 
or  blunt  force  (car  crash)  is  possible.  The  filling  level  is  an  important  parameter.  Such 
experiments  have  so  far  mainly  been  made  with  motorcar  tanks  with  a  volume  of  about 
120  1. 

13.5.  Componen  ts  and  equipmen  t 

There  is  a  necessity  to  investigate  connections,  equipment,  safety  devices,  control  devices, 
and  so  on  for  reliability  in  extended  service  in  connection  wath  hydrogen.  Experience  of 
BAM  or  other  test  institutes  is  of  limited  value  because  “lowr  temperature"  for  pressure 
vessel  valves  usually  means  —  20  C.  A  catalogue  of  requirements  and  a  test  program  must 
be  agreed  upon  at  first.  They  can  be  improved  on  the  basis  of  sample  tests. 

What  is  true  for  valves  holds  also  for  pipes  and  connections.  Make-and-break  connections 
in  particular  merit  special  attention,  also  tank  couplings  because  they  are  used  several  times 
per  day  on  a  regular  basis. 

13.6.  Air  ingress  in  aircraft  tanks 

It  will  be  almost  impossible  to  totally  prevent  the  ingress  of  traces  of  air  into  the  tanks 
when  they  are  refilled.  Since  a  Cryoplane  may  remain  in  service  with  cold  tanks  for  up  to 
18  months  with  several  tank  procedures  per  day.  even  small  amounts  may  accumulate 
considerably.  Solid  oxygen  and  liquid  hydrogen  are  known  to  form  a  detonative  mixture. 
Procedures  and  devices  are  necessary  to  avoid  air  ingress  into  the  tanks  as  far  as  possible, 
and  to  find  out  whether  solid  oxygen  is  present  in  the  tanks  and  to  get  rid  of  it. 

13.7.  A  ire  raft  tank  burst 

An  aircraft  accident,  in  particular  a  crash  landing,  is  not  an  event  but  a  process.  The 
severity  of  the  wffiole  accident  depends  not  only  on  the  individual  stages  but  also  on  how' 
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they  interact  with  each  other.  The  aircraft  tank  prototypes  should  undergo  a  test  program 
comparable  to  the  one  for  the  airport  storage  tanks. 

For  Cryoplane  purposes  the  effects  of  one  damaged  tank  should  be  investigated  first. 
Matters  to  be  looked  into  include  the  effects  on  still  intact  tanks  or  embrittlement  and 
fracture  of  parts,  or  leakage  of  flanges  due  to  cooling.  Also  interesting  is  the  effect  of  a 
hydrogen  fire  on  still  intact  tanks  with  either  working  or  damaged  insulation  and  on  pipes, 
connections,  and  equipment. 

The  comparison  of  the  results  with  those  for  conventional  aircrafts  would  show  whether 
hydrogen  is  more  or  less  likely  to  cause  damage  after  a  crash  than  kerosene. 

13.8.  Large  scale  LH2  release 

Various  questions  related  to  the  release  of  large  amounts  of  LH2,  no  matter  whether 
instantaneous  or  continuous,  should  be  resolved  “Large”  would  mean  amounts  of  the 
order  of  10  t  (140  m3),  comparable  to  the  amount  on  board  of  a  Cryoplane.  Extent  and 
shape  of  the  clouds,  how  fast  they  become  stationary  under  constant  release  rate,  and  how 
fast  they  disperse  after  the  release  stops,  are  matters  of  interest. 

The  next  step  would  be  the  ignition  of  the  cloud  and  the  measurement  of  the  pressure 
wave  and  the  heat  radiation.  This  must  be  done  under  realistic  conditions.  The  spill  of  fuels 
which  are  liquid  at  ambient  temperatures  may  generate  an  aerosol  cloud  the  ignition  of 
which  can  have  devastating  consequences.  This  has  not  been  observed  for  hydrogen  and  is 
not  easy  to  imagine,  but  could  be  a  subject  for  investigation. 

For  the  purpose  of  accident  effect  assessment  it  is  important  to  know  whether  escaping 
LH2  will  form  pools  on  the  ground,  how  great  they  can  be,  and  how  fast  they  vaporize. 
Experiments  have  mainly  been  done  using  LN2  [18];  first  LH2  measurements  were  made 
during  the  recent  BAM  experiments  [21].  Other  systematic  investigations  for  hydrogen  do 
not  exist,  but  will  be  made  [55].  Parameters  are  the  release  rate,  the  nature  of  the  ground, 
ground  and  air  temperature,  and  other  boundary  conditions. 

13.9.  Fire  effects 

Experience  shows  that  many  victims  of  crash  landings  suffer  not  so  much  from  the  crash 
itself,  but  from  subsequent  fire.  It  would  be  worthwhile  to  study  the  effect  of  a  fuel  fire  near 
the  tanks  on  the  fuselage.  This  must  be  done  under  realistic  conditions.  Comparative 
experiments  with  kerosene  can  be  made. 

13.10.  Ignition  and  combustion 

Lean  hydrogen/air  mixtures  are  more  interesting  for  safety  considerations  than  those 
with  high  concentration.  Their  deflagration/detonation  behaviour  is  as  yet  not  known  to  a 
satisfactory  degree.  This  could  be  done  in  medium  sized  experiments,  for  example  by 
igniting  gas  in  a  balloon.  Balloon  results,  however,  do  not  give  comprehensive  information 
about  the  ignition  behaviour  in  long  ducts,  so  that  the  latter  will  have  to  be  performed  also. 

13.11.  Physiological  effects 

Liquid  hydrogen  may  drip  down  and  affect  the  passengers  if  the  fuselage  and  a  tank 
break.  It  is  not  clear  whether  hydrogen  can  enter  a  still  more  or  less  intact  fuselage  and 
cause  a  dangerously  low'  oxygen  content  of  the  air.  This  matter  might  be  clarified  in  a  large 
scale  experiment.  “Cold  burns”  may  occur  if  the  liquid  does  not  vaporize  quickly  or  if  it  is 
not  rejected  by  the  warm  skin.  Injury  might  be  possible  if  it  intrudes  in  collars  or  sleeves. 
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13.12.  Modelling 

Numeric  methods  can  be  used  to  predict  the  effects  of  a  hydrogen  release.  Most  present 
programs  for  the  treatment  of  industrial  accident  situations  are,  however,  not  suitable  for 
hydrogen  because  a  gas  with  such  a  low  density  is  difficult  to  treat  mathematically.  Most 
programs  are  for  gases  with  a  density  greater  than  that  of  air  or  at  least  similar.  This  is  a 
field  for  development,  because  hydrogen  will  become  important. 

The  situation  might  be  improved  by  the  calibration  of  principally  suitable  programs  by 
means  of  experimental  results.  The  results  of  the  recent  BAM  experiments  on  cloud  dis¬ 
persion  [20,  21,  43]  will  be  used  for  this  purpose,  as  far  as  possible.  Of  particular  practical 
interest  is  the  dispersion  in  realistic  environments,  like  streets  or  industrial  plants.  An 
alternative  would  be  experiments  with  artificial  obstacles  like  grids  because  they  are  better 
comparable  with  numerical  results.  Another  process  lending  itself  to  numerical  analysis  is 
pool  formation  and  behaviour.  There  are  results  from  the  recent  BAM  experiments  [21], 
and  more  systematic  studies  will  follow  [18,  55]. 

Also  numerically  accessible  are  the  effect  s  of  a  gas  cloud  ignition.  Most  present  programs 
do  not  deliver  satisfactory  results,  however,  because  extent  and  shape  of  a  cloud  or  plume 
are  difficult  to  estimate  for  the  reasons  explained  above.  Another  problem  is  to  make  an 
assumption  on  how  much  gas  takes  part  in  a  reaction. 

These  problems  could  be  treated  by  means  of  a  number  of  standardized  accident  scenarios 
and  comparison  of  the  results  among  each  other  and  with  experiments. 


14.  SUMMARY  AND  OUTLOOK 

This  study  cannot  cover  all  safety  matters  related  to  the  development  of  a  hydrogen 
aircraft  like  Cryoplane.  The  latter’s  design  process  is  anything  but  finished,  to  mention  just 
one  reason.  The  basic  outlines,  however,  can  be  discussed  and  judged  in  the  same  way  as 
in  other  applications  of  safety  engineering  such  as  the  chemical  industry,  surface  vehicles, 
and  plants  and  devices  of  any  kind.  The  experience  gathered  in  tests  and  approval  pro¬ 
cedures  under  environmental  legislation  can  also  be  used. 

What  has  been  done  here  is  a  discussion  of  the  installations  on  the  airport  and  on  board 
of  the  aircraft.  The  most  important  risks  were  identified,  and  protective  measures  for  design, 
operation,  and  emergency  were  considered. 

The  result  is  that  the  Cryoplane  and  its  infrastructure  are  feasible  from  the  point  of  view 
of  safety.  The  risks  are  not  greater  than  those  associated  with  any  other  great  industrial 
plant,  some  of  them  even  smaller.  They  can  be  dealt  with  by  means  of  measures  which  are 
state  of  the  art  already  now.  The  safety  of  aviation  would  not  be  affected. 

The  really  new  thing  is  that  the  necessary  installations  would  be  much  greater  than  all 
existing  ones.  It  is  likely,  however,  that  hydrogen  fuel  will  be  introduced  not  only  in  aviation, 
but  in  the  energy  technology  generally.  The  reasons  (supply  and  environment)  are  the  same 
as  for  aviation,  and  they  are  equally  compelling.  This  means  that  there  will  soon  be  hydrogen 
plants  of  today  unknown  size,  and  this  quite  independent  of  aircraft  development.  The  load 
of  the  work  thus  rests  not  only  on  the  shoulders  of  the  aviation  industry. 

While  the  safety  problems  associated  with  the  Cryoplane  are  solvable,  they  should  not 
be  taken  lightly.  All  parties  who  have  an  interest  in  the  future  and  the  progress  of  aviation 
must  increase  their  research  and  development  efforts,  and  they  should  look  for  ways  to  do 
at  least  some  tasks  jointly.  As  long  as  hydrogen  technology  is  not  yet  generally  approved 
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and  accepted,  their  assets  should  be  put  to  work  together  instead  of  wasting  them  in 
premature  competition. 

Results  should  be  disseminated  in  a  suitable  form  to  help  convince  the  public  of  the 
safety  of  hydrogen  technology.  This  is  a  task  in  which  both  industry  and  state  institutions 
can  take  part. 

The  real  problems  for  the  introduction  of  hydrogen  in  aviation  and  generally,  are  not 
technical  in  nature,  but  political  and  economical.  The  necessary  investments  may  not  be 
available  in  the  near  future,  but  may  be  more  abundant  in  the  distant  future.  The  work 
done  today  on  Cryoplane  and  other  projects  of  the  same  direction  is  a  valuable  contribution 
to  the  future  not  only  of  aviation,  but  of  our  technical  civilisation  generally. 


REFERENCES 

1.  Winter,  C.  J.,  Hydrogen  Technologies  for  Future  Aircraft,  Proceedings  of  the  Inter¬ 
national  Seminary  of  DLE ,  Bonn,  15,  16  November  1990. 

2.  Pohl,  H.-W.  and  Malychev,  V.  V.,  Hydrogen  in  future  civil  aviation,  Hydrogen  Energy 
Progress  X,  1994,  1969-1978. 

3.  Kocer,  K.  and  Veziroglu  T.  N.,  Liquid  hydrogen  powered  commercial  aircraft,  Hydro¬ 
gen  Energy  Progress  X,  1994,  2057-2066. 

4.  Quick,  L.  H.,  Megalopolis  Airport  Requirements,  presented  at  the  3rd  Annual  Meeting 
of  the  American  Institute  of  Aeronautics  and  Astronautics ,  Boston. 

5.  Behrend,  E.,  Jaenicke,  B.,  Krafka,  H.  and  Schmidtchen,  U.,  Folgenschwere 
Explosion — Bericht  tiber  Ursachen  and  Hergang  des  Berstens  eines  Was- 
serstoffbehalters  in  Hanau,  TU  Technische  Uberwachung ,  1993,  34,  176-179,  225-229. 

6.  Jenkins,  I.,  A  Survey  of  Hydrogen  Safety  Experience  and  Incidents;  with  an  Evaluation 
for  Use  on  Aircraft,  Proceedings  of  the  European  Safety  and  Reliability  Conference , 
1994. 

7.  Behrend,  E.,  Schmidtchen,  U.  and  Meyer,  W.,  Permeation  of  Helium  through  Polymers 
at  Low  Temperatures,  Proceedings  of  the  12th  International  Cryogenic  Engineering 
Conference.  Butterworth,  GB,  Guildford,  1988,  pp.  437-441. 

8.  Schmidtchen,  U.,  Gradt,  T.,  Borner,  H.  and  Behrend,  E.,  Temperature  behaviour  of 
the  permeation  of  helium  through  vespel  and  torlon,  Cryogenics ,  1994,  34,  105-109. 

9.  Hord,  J.,  Is  Hydrogen  Safe?  NBS  Technical  Note  690,  Boulder  (Colorado,  U.S.A.), 
October  1976. 

10.  Fenn,  D.  B.,  Acker,  L.  W.  and  Algranti,  J.  S.,  Flight  Operation  of  a  Pump-Fed ,  Liquid- 
Hydrogen  Fuel  System ,  NASA  TM  X-252,  Cleveland  (Ohio)  U.S.A.,  April  1960. 

11.  Deutsche  Aerospace  Airbus  GmbH:  Cryoplane — Deutsch-Russisches  Geme- 
inschaftsproiekt  zum  Einsatz  kryogener  Treibstoffe  in  der  zivilen  Luftfahrt ,  Feasibility 
Study  1990-1992,  Hamburg,  1992. 

12.  Brewer,  G.  D.  (Ed.),  LH2  Airport  Requirements  Study,  NASA  Contractor  Report  CR- 
2700,  October  1976,  Washington,  USA. 

13.  Boeing  Preliminary  Design  Department,  An  Exploratory  Study  To  Determine  the  Inte¬ 
grated  Technological  Air  Transportation  System  Ground  Requirements  of  Liquid- Hydro¬ 
gen- Fueled  Subsonic ,  Long-Haul  Civil  Air  Transports ,  NASA  Contractor  Report  CR- 
2699,  September  1976,  Washington,  U.S.A. 

14.  Alder,  H.  P.  (Ed.),  Hydrogen  in  Air  Transportation — Feasibility  Study  for  Zurich 
Airport ,  Switzerland ,  Eidgenossisches  Institut  fur  Reaktorforschung,  Report  No.  600, 
CH-Wurenlingen,  September  1986. 

1 5.  Gretz,  J.,  Baselt,  J.  P.,  Ullmann,  O.  and  Wendt,  H.,  The  100  MW  Euro-Quebec  Hydro- 
Hydrogen  Pilot  Project,  Int.  J.  Hydrogen  Energy ,  1990,  15,  419-424. 


268 


U.  SCHM1DTCHEN  et  ai 


16.  Drolet,  B.,  Gretz,  J.,  Kluyskens,  D.,  Sandmann,  F.  and  Wurster,  R.,  The  Euro-Quebec 
Hydro-Hvdrogen  Pilot  Project  (EQHHPP):  Demonstration  Phase,  Hydrogen  Energy 
Progress  X\  1 994,  23^*6. 

17.  Safety  Guide  for  Hydrogen ,  National  Research  Council  of  Canada,  Flydrogen  Safety 
Committee,  1897. 

18.  Bongartz,  B.,  Dienhart,  B.,  Marx,  J.,  Stauch,  B.  and  Verfondern.  K.,  Selected  aspects 
of  a  safety  analysis  in  a  hydrogen  energy  economy.  Hydrogen  Progress  X  (1994)  225 
234. 

19.  Transport  und  Umschlag  von  tiefgekuhlt  verflussigtem  Erdgas  (TNG)  und  unter  Druck 
sowie  tiefgekuhlt  verfliissigten  Kohlenwasserstoffen  (LPG)  mit  Seeschiffen  auf  deutschen 
See-SchiffahrtstraRen — Risikoabschatzung,  Bundesministerium  fur  Verkehr,  Arbeits- 
gruppe  des  Beirates  fur  die  Beforderung  gefahrlicher  Outer;  Bonn,  December  1984. 

20.  Schmidtchen,  U.  and  Marinescu-Pasoi,  L.,  Dispersion  of  hydrogen  and  propane  gas 
clouds  in  residential  areas,  Hydrogen  Progress  X,  1994,  255-260. 

21.  Schmidtchen,  U.,  Marinescu-Pasoi,  L.,  Verfondern,  K.,  Nickel,  V.,  Sturm,  B.  and 
Dienhart,  B.,  Simulated  Accidental  Spill  of  Cryogenic  Hydrogen  in  a  Residential  Area, 
Cryogenics ,  1994,  34(ICEC  15  Suppl.),  401-404. 

22.  Rehm,  W.  and  Jahn,  W.,  Beitrag  zur  Answer  twig  von  Ballon- Experimen  ten  zu  den 
A usbreitungsfunktionen  von  detonierenden  Was sers toff- Luft-Gem ischen  mit  Anwendungs - 
fallen ,  Reports  of  Research  Centre  Julich  No.  2854,  December,  1993. 

23.  Baker,  W.  E,,  Kulesz,  J.  J.,  Ricker,  R.  E.,  Westine,  P.  S.,  Parr,  V.  B.,  Vargas,  L.  M.  and 
Mosley,  P.  K.,  Workbook  for  Estimating  Effects  of  Accidental  Explosions  in  Propellant 
Ground  Handling  and  Transport  Systems ,  NASA  Contractor  Report  3023,  August, 
1978. 

24.  Edeskuty,  F.  J.,  Safety  of  liquid  hydrogen  in  air  transportation,  International  DFVLR 
Symposium :  Hydrogen  in  Air  Transportation ,  Stuttgart,  1979. 

25.  Brewer,  G.  D.,  The  relative  crash  safety  of  LH2- fueled  aircraft.  Hydrogen  Energy 
Progress  I F,  1 982,  1697-1715. 

26.  Rich,  B.  R.,  Lockheed  CL-400  Liquid  Hydrogen  Fueled  Mach  2.5  Reconnaissance 
Vehicle,  presented  at  the  Working  Symposium  of  LH2-Fueled  Aircraft,  NASA-Langley 
Research  Centre,  15,  16  May  1973. 

27.  Interim  Report  on  an  Investigation  of  Hazards  Associated  with  Liquid  Hydrogen  Storage 
and  Use ,  Arthur  D.  Little  Inc,  15  January  1959. 

28.  Witcofski,  R.  D.,  Dispersion  of  Flammable  Clouds  Resulting  from  Large  Spills  of  Liquid 
Hydrogen ,  NASA  Technical  Memorandum  83131,  May,  1981. 

29.  Witcofski,  R.  D.  and  Chirivella,  J.  E.,  Experimental  and  analytical  analyses  of  the 
mechanisms  governing  the  dispersion  of  flammable  clouds  formed  by  liquid  hydrogen 
spills,  Int.  J.  Hydrogen  Energy ,  1984,  9,  425-435. 

30.  Verordnung  liber  Druckbehdlter ,  Dnickgasbe halter  and  Fullanlagen  ( Druck - 
behdlterverordnung — DruckhehV). 

31.  Verordnung  iiber  elektrische  Anlagen  in  explosionsgefdhrdeten  Rdumen  (ElexV). 

32.  Verordnung  iiber  Arbeitsstdtten  (Arbeitsstattenverordnung — ArbStattV). 

33.  Gesetz  zum  Schutz  vor  gefahr lichen  Stoffen  (Chemikaliengesetz — ChemG);  Verordnung 
iiber  gefahrliche  Stoffe  (Gefahrstoffverordnung — GefStoffV). 

34.  Gesetz  zum  Schutz  vor  schadlichen  Umwelteinwirkungen  durch  Luftvernnre in ig ungen , 
Gerdusche ,  Erschut  ter  ungen  and  dfmliche  Vorgange  (Bundes-Immissionsschutzgesetz); 
Zwolfte  Verordnung  zur  Durchfuhrung  des  Bundes-Immissionsschutzgesetzes  (Stor- 
fallverordnung). 

35.  Schmidtchen,  U.,  Gradt,  T.,  Wursig,  G.  and  Meyer,  W.,  Safe  handling  of  large  amounts 
of  liquid  hydrogen,  Cryogenics ,  1993,  3,  813-817. 

36.  Schmidtchen,  U.  and  Wursig.  G.,  Lagenmg  and  Seetransport  grower  Mengen  flussigen 


269 


Hydrogen  aircraft  and  airport  safety 

Wasserstoffs  am  Beispiel  des  Euro-Quebec  Hydro-Hydrogen  Pilot  Project — Uberblick 
iiber  die  in  Deutschland  anzuwendenden  Gesetze,  Verordnungen  and  Technischen 
Regeln,  BAM  Research  Report  No.  195,  Berlin,  Wirtschaftsverlag  NW,  Bremerhafen, 
1993. 

37.  Tachtler,  J.  and  Szyszka,  A.,  Car  fueling  with  liquid  hydrogen,  Linde  Reports  on  Science 
and  Technology ,  1993,  51,  31-38. 

38.  Bracha,  M.,  Lorenz,  G.,  Patzelt,  A.  and  Wanner,  M.,  Large-scale  hydrogen  liquefaction 
in  Germany,  Int.  J .  Hydrogen  Energy ,  1994,  19,  53-59. 

39.  Linde,  Fa.  (U.S.  A . ),  Survey  Study  of  the  Efficiency  and  Economics  of  Hydrogen  Liquefac¬ 
tion ,  NASA  Contractor  Report  CR- 132631,  April,  1975. 

40.  Jones,  L.,  Wuschke,  C.  and  Fahidy,  T.  Z.,  Model  of  a  cryogenic  liquid-hydrogen 
pipeline  for  an  airport  ground  distribution  system,  Int .  J.  Hydrogen  Energy ,  1983,  8, 
623-630. 

41.  Gesetz  iiber  die  Umweltvertrdglichkeitsprufung  iUVPG). 

42.  Ordin,  P.  M.,  Review  of  Hydrogen  Accidents  and  Incidents  in  NASA  Operations ,  NASA- 
TM  X  7 1 656,  26  August  1*974.' 

43.  Rastogi,  A.  K.  and  Marinescu-Pasoi,  L.,  Numerical  simulation  of  hydrogen  dispersion 
in  residential  areas,  Hydrogen  Energy  Progress  X,  1994,  245-254. 

44.  UVV  Case  (VBG  61). 

45.  Deutsche  Aerospace  Airbus,  Lufttuchtigkeit  and  deren  Aufrechterhaltung ,  GQ21- 
478/10/93. 

46.  Rotenberg,  Y.,  Vibration  enhanced  boil-off  rate  from  a  cryogenic  hydrogen  tank. 
Hydrogen  Energy  Progress  VL  1986,  164—172. 

47.  Petrac,  D.  and  Mason,  P.  V.,  Infrared  Astronomical  Satellite  (IRAS)  superfluid  helium 
tank  temperature  control,  Adv.  Cryog.  Engng .,  1984,  29,  661-667. 

48.  Denner,  H.-D.,  Klipping,  G.,  Klipping,  I.,  Ltiders,  K.,  Oestereich,  T.,  Ruppert,  U., 
Schmidtchen,  U.,  Szucs,  Z.  and  Walter,  H.,  Improved  active  phase  separator  for  helium 
II  space  cooling  systems,  Adv .  Cryog .  Engng.,  1982,  27,  1079-1086. 

49.  Engel,  J.,  Klipping,  G.  and  Walter,  H.,  Evaporation  losses  during  handling  of  liquid 
helium.  Proceedings  of  the  ICEC  6,  1976. 

50.  Zalosh,  R.  and  Short,  T.,  Comparative  Analysis  of  Hydrogen  Fire  and  Explosion  Inci¬ 
dents \  Factory  Mutual  Research  Corporation,  Norwood,  U.S. A.,  28  February  1978. 

51.  Wybranowski,  E.,  A  10,000-gpm  liquid  hydrogen  transfer  system  for  the  Saturn/Apollo 
program,  Adv .  Cryog .  Engng.,  1971,  17,  147-155. 

52.  Hettinger,  W.,  LH^  Tankstelle  fur  wasserstoffbetriebene  Fahrzeuge,  DKV  Tagungs- 
hericht  21  Vol.  I  p.  203-218. 

53.  Droste,  B.,  Mallon,  M.  and  Probst,  U.,  Neuartige  Brandschutzbeschichtungen  fur 
Flussiggas-Lagertanks,  TU  Technische  Uberwachung ,  1989,  30,  166-172. 

54.  Droste,  B.,  Die  Bewertung  der  Sicherheit  von  UmschlieBungen  zur  Lagerung  von 
Flussiggas.  In  Kolloquium  iiber  Fragen  der  Chemischen  Sicherheit stechnik ,  5.,  ed.  H. 
Steen.  BAM,  Berlin,  1990,  83-101.  ' 

55.  Dienhart,  B.  (Research  Centre  Julich),  Thesis  (in  prep.). 


